release: v0.11.1 [skip ci]

.gitea/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
           PYTHONPATH: src
         run: |
           . .venv/bin/activate
-          python3 -m devx.tools.check_test_speed --max-seconds 10
+          python3 -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
       - name: Documentation coverage check
         env:
           PYTHONPATH: src
@@ -120,8 +120,8 @@ jobs:
 
   auto-merge:
     # Auto-merge runs after all CI checks pass. It reads the task ID
-    # from .taskid file, validates the PR title, and squash-merges.
-    # No manual label or review needed — CI is the quality gate.
+    # from the branch name (falling back to .taskid file), validates
+    # the PR title, and squash-merges.
     needs: [quality, detect-changes, pr-review]
     if: github.event_name == 'pull_request'
     runs-on: docker

.gitea/workflows/post-merge.yml

@@ -75,7 +75,7 @@ jobs:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
@@ -94,12 +94,32 @@ jobs:
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release
+      - name: Publish release
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -z "$TAG" ]; then
+            echo "No tag found — skipping publish"
+            exit 0
+          fi
+          HEAD_MSG=$(git log -1 --format=%s)
+          if echo "$HEAD_MSG" | grep -q "^release: ${TAG}"; then
+            echo "Publishing release $TAG..."
+            python3 -m devx.ci.publish "$TAG" "${{ github.repository }}"
+          else
+            echo "HEAD is not a release commit for $TAG — skipping publish"
+          fi
       - name: Notify on failure
         if: failure()
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYTHONPATH: src
         run: |
+          . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.tools.install_tools --tool tea
           tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true

.gitea/workflows/publish.yml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g. v0.9.11)'
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -34,7 +40,7 @@ jobs:
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.publish "${{ github.ref_name }}" "${{ github.repository }}"
+          python3 -m devx.ci.publish "${{ github.event.inputs.tag || github.ref_name }}" "${{ github.repository }}"
       - name: Notify on failure
         if: failure()
         env:

.gitignore

@@ -35,3 +35,6 @@ Thumbs.db
 
 # Badges
 .badges/
+
+# Deprecated CI task tracking (branch name is the sole source of truth)
+.taskid

.taskid

@@ -1 +0,0 @@
-DEVX-8

AGENTS.md

@@ -55,16 +55,20 @@ src/devx/
 ├── translations.json    # Translation strings (en, bg)
 ├── ci/                  # CI/CD automation modules (run by workflows)
 │   ├── release.py       # Automated versioning, tagging, changelog
-│   ├── publish.py       # Build and publish to Gitea PyPI registry
+│   ├── publish.py       # Build and publish to Gitea PyPI registry (--skip-build for non-Python repos)
 │   ├── auto_merge.py    # Squash-merge PRs with task ID validation
+│   ├── _shared.py      # Shared utilities (get_latest_tag)
 │   ├── classify_changes.py  # User-facing vs workflow-only change detection
 │   ├── detect_release_commit.py  # Detect release commits on master
 │   ├── validate_commit_msg.py    # Conventional commit validation
 │   ├── pr_review.py     # Automated PR review
 │   ├── post_merge.py    # Vikunja task updates after merge
 │   ├── sync_wiki.py     # Sync documentation to Gitea wiki
-│   ├── push_badges.py   # Generate and push quality badges
-│   ├── notify_failure.py    # Create Gitea issues on CI failures
+│   ├── push_badges.py   # Generate and push quality badges (--retries for retry on git push failures)
+│   ├── notify_failure.py    # Create Gitea issues on CI failures (--auto-login)
+│   ├── merge_junit.py   # Merge JUnit XML reports from parallel runners
+│   ├── distribute_files.py  # Distribute files across parallel runners
+│   ├── integration_guard.py # Run pytest with cross-runner fail-fast + JUnit output
 │   ├── check_translations.py  # Translation completeness check
 │   └── doc_coverage.py  # Documentation coverage check
 ├── tools/               # Developer tooling modules (run locally or by CI)
@@ -73,7 +77,13 @@ src/devx/
 │   ├── check_test_speed.py  # Measure unit test execution time
 │   ├── configure_repo.py    # Branch protection and label setup
 │   └── generate_badges.py   # Badge SVG generation
+├── opentofu.py          # OpenTofu output helpers (get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field)
 └── molecule/            # Optional molecule testing helpers (for Ansible projects)
+    ├── discover_runners.py    # Dynamic Gitea runner discovery
+    ├── distribute_molecule.py # Distribute molecule scenarios across runners (--roles-root for multi-role)
+    ├── molecule_ci_guard.py   # Run molecule with cross-runner fail-fast + JUnit output (--roles-root, --junit-output)
+    ├── molecule_all.py        # Run all molecule scenarios locally
+    └── platforms.py           # Supported molecule platforms
 ```
 
 ### Key Design Principles
@@ -275,6 +285,32 @@ setuptools via `dynamic = ["version"]` in `pyproject.toml`.
 | PR title | `DEVX-N: <vikunja task title>` | `DEVX-12: Add release automation` |
 | Merge commit | `DEVX-N <conventional commit>` | `DEVX-12 feat: add release script` |
 
+### Task ID Resolution
+
+`auto_merge` resolves the task ID solely from the branch name (e.g.
+`DEVX-12-fix-foo` → `DEVX-12`). Branch names must include the task ID
+prefix — there is no `.taskid` file fallback. If a stale `.taskid` file
+exists in the repo, a deprecation warning is printed advising its removal.
+
+### Workflow `auto-merge` Job and `always()`
+
+When `auto-merge` depends on a job that can be skipped (e.g.
+`molecule-tests`), the `if:` condition MUST include `always() &&`
+at the start. Without it, Gitea Actions skips `auto-merge` when any
+dependency is skipped, even if the condition explicitly allows
+`result == 'skipped'`.
+
+```yaml
+auto-merge:
+  needs: [quality, detect-changes, pr-review, molecule-tests]
+  if: >-
+    always() &&
+    github.event_name == 'pull_request' &&
+    needs.quality.result == 'success' &&
+    needs.pr-review.result == 'success' &&
+    (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
+```
+
 ## Config System
 
 devx uses environment variables with `.env` file fallback for configuration.
@@ -285,6 +321,10 @@ devx uses environment variables with `.env` file fallback for configuration.
 |----------|---------|-------------|
 | `DEVX_GITEA_API_URL` | `https://git.oblachno.oblachno.fyi/api/v1` | Gitea API base URL |
 | `DEVX_VIKUNJA_API_URL` | `https://work.oblachno.oblachno.fyi/api/v1` | Vikunja API base URL |
+| `DEVX_REPO_OWNER` | **(none — must be set)** | Repository owner for API calls |
+| `DEVX_REPO_NAME` | **(none — must be set)** | Repository name (or `owner/repo`) |
+| `DEVX_TASK_PREFIX` | `DEVX` | Task ID prefix (GRM, OBL-INFRA, etc.) |
+| `DEVX_VIKUNJA_PROJECT_ID` | `6` | Vikunja project ID |
 | `DEVX_LANG` | `en` | Language for i18n (en, bg) |
 | `REPO_TOKEN` | (from .env) | Gitea API token |
 | `VIKUNJA_TOKEN` | (from .env) | Vikunja API token |

CHANGELOG.md

@@ -2,6 +2,185 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.11.1] - 2026-06-24
+
+### Bug Fixes
+
+- Add build/twine to ci deps, activate venv in notify_failure
+
+## [0.11.0] - 2026-06-24
+
+### Features
+
+- Add publish step to post-merge release job, make publish idempotent
+
+## [0.10.2] - 2026-06-24
+
+### Bug Fixes
+
+- Badge generation respects pyproject.toml testpaths, shows stdout in warnings
+
+## [0.10.1] - 2026-06-24
+
+### Bug Fixes
+
+- Badge generation REPO_ROOT, auto-detect package, error feedback
+
+## [0.10.0] - 2026-06-24
+
+### Features
+
+- Remove .taskid file fallback, use branch name only
+
+### Bug Fixes
+
+- Use raw/branch/badges/ URLs for badges in README and docs
+
+## [0.9.12] - 2026-06-24
+
+### Bug Fixes
+
+- Clean dist/ before build and add workflow_dispatch to publish
+
+## [0.9.11] - 2026-06-24
+
+### Bug Fixes
+
+- Use raw/branch/badges/ URLs for badges in README and docs
+- Resolve repo_root from GITHUB_WORKSPACE or cwd
+
+## [0.9.10] - 2026-06-24
+
+### Bug Fixes
+
+- Retrospective fixes for CI/CD friction
+
+## [0.9.9] - 2026-06-24
+
+### Bug Fixes
+
+- Use DOCKER_HOST env var in is_docker_ready + scan all rootless sockets
+- Prefer branch name for task ID extraction + strip heads/ prefix in release
+- Filter non-version tags in release verification
+- Use explicit refspecs for git push to avoid tag/branch ambiguity
+
+## [0.9.8] - 2026-06-24
+
+### Bug Fixes
+
+- Use DOCKER_HOST env var in is_docker_ready + scan all rootless sockets
+
+## [0.9.7] - 2026-06-24
+
+### Bug Fixes
+
+- Add rootless socket fallback and GITHUB_ENV export
+
+## [0.9.6] - 2026-06-24
+
+### Bug Fixes
+
+- Add Docker socket diagnostics to start_docker
+- Add Docker socket diagnostics to start_docker
+
+## [0.9.5] - 2026-06-24
+
+### Bug Fixes
+
+- Use host Docker socket with DOCKER_HOST fallback to local dockerd
+- Use host Docker socket with DOCKER_HOST fallback to local dockerd
+
+## [0.9.4] - 2026-06-24
+
+### Bug Fixes
+
+- Use separate Docker socket for DinD in CI
+
+## [0.9.3] - 2026-06-24
+
+### Bug Fixes
+
+- Use tempfile for dockerd log to fix CI permission error
+
+## [0.9.2] - 2026-06-24
+
+### Bug Fixes
+
+- Use vfs storage driver for Docker-in-Docker in CI
+
+## [0.9.1] - 2026-06-23
+
+### Bug Fixes
+
+- Always start dockerd in CI runner for molecule tests
+
+## [0.9.0] - 2026-06-23
+
+### Features
+
+- Extract Docker daemon start to tested Python module
+
+## [0.8.5] - 2026-06-23
+
+### Bug Fixes
+
+- Retry pip install with --ignore-installed only on failure
+
+## [0.8.4] - 2026-06-23
+
+### Bug Fixes
+
+- Add --ignore-installed to pip in CI to bypass debian packages
+
+## [0.8.3] - 2026-06-23
+
+### Bug Fixes
+
+- Lower check_test_speed threshold to 4 seconds
+- Pass --break-system-packages to pip in CI environments
+
+## [0.8.2] - 2026-06-23
+
+### Bug Fixes
+
+- Encode spaces in pair commands to survive shell word-splitting
+
+## [0.8.1] - 2026-06-23
+
+### Bug Fixes
+
+- Set fresh MOLECULE_HOME per pair to avoid stale config cache
+
+## [0.8.0] - 2026-06-23
+
+### Features
+
+- Fix molecule platforms to use sleep infinity, add --platforms-file
+
+## [0.7.0] - 2026-06-23
+
+### Features
+
+- Add per-test timing quality gate to check_test_speed
+
+## [0.6.0] - 2026-06-23
+
+### Features
+
+- Add opentofu helpers, CLI entry points, shared utility, and CI improvements
+
+## [0.5.0] - 2026-06-23
+
+### Features
+
+- Add tag verification, idempotency, and --verify mode to release script
+
+## [0.4.4] - 2026-06-22
+
+### Bug Fixes
+
+- Configurable task prefix and CWD-relative DOCS_DIR
+
 ## [0.4.3] - 2026-06-22
 
 ### Bug Fixes
@@ -25,27 +204,30 @@ All notable changes to this project will be documented in this file.
 ### Features
 
 - Add DEFAULT_INFRASTRUCTURE and configurable task prefix
+
 ## [0.3.0] - 2026-06-22
 
 ### Features
 
 - Add --no-ansible-collections option to setup tool
+
 ## [0.2.0] - 2026-06-22
 
 ### Features
 
 - Pluggable change classification framework
+
 ## [0.1.2] - 2026-06-22
 
 ### Bug Fixes
 
 - Make sync-wiki and vikunja depend on release
+
 ## [0.1.1] - 2026-06-22
 
 ### Bug Fixes
 
 - Disable push whitelist, allow direct pushes to master
-## [0.1.0] - 2026-06-22
 
 ## [0.1.0] - 2026-06-22
 

README.md

@@ -1,16 +1,61 @@
 # devx — Reusable Development & CI/CD Tools
 
-A Python package providing reusable development and CI/CD automation tools for oblachno-oss projects. devx consolidates release management, PR automation, wiki sync, badge generation, translation checks, and more into a single installable package.
+A Python package providing reusable development and CI/CD automation tools for
+oblachno-oss projects. devx consolidates release management, PR automation,
+wiki sync, badge generation, translation checks, documentation coverage,
+parallel test distribution, and more into a single installable package.
+
+It was extracted from the [GRM](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
+project to be reusable across all oblachno-oss repositories. Any project hosted
+on a Gitea instance with Gitea Actions can install devx and inherit a complete,
+opinionated CI/CD pipeline: conventional commits, automated versioning via
+git-cliff, squash-merge automation, Vikunja task tracking, wiki sync, and
+quality badges.
 
 > An open-source project from **Oblachno** (облачно means *cloudy* in Bulgarian).
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/badges/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/badges/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/badges/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/badges/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/badges/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/python.svg)](https://www.python.org/downloads/)
+
+## Why devx?
+
+Every oblachno-oss project shares the same CI/CD needs: automated releases,
+PR review, task tracking, documentation sync, and quality badges. Without a
+shared package, each repository duplicates this logic in shell scripts and
+workflow YAML, leading to drift, bugs, and maintenance burden.
+
+devx solves this by providing a single, tested Python package that any
+oblachno-oss project can install. The project declares its configuration via
+environment variables and `pyproject.toml`, and devx handles the rest. Updates
+to the CI/CD pipeline ship as new devx releases — consumer projects pick them
+up by bumping their devx dependency.
+
+### Key features
+
+- **Automated releases** — git-cliff-driven semver versioning, changelog
+  generation, tagging, and publishing to a Gitea PyPI registry.
+- **PR automation** — squash-merge with task ID validation, automated PR
+  review with inline comments, and conventional commit enforcement.
+- **Smart change classification** — user-facing vs workflow-only change
+  detection so infrastructure-only changes skip releases.
+- **Documentation sync** — push `docs/` markdown to the Gitea wiki with
+  integrity verification.
+- **Quality badges** — generate self-contained SVG badges for coverage,
+  tests, docs, quality, version, and Python version.
+- **Translation checks** — validate i18n keys against source code, detect
+  dead keys and missing languages.
+- **Parallel test distribution** — split test files or molecule scenarios
+  across CI runners with cross-runner fail-fast.
+- **Developer tools** — environment setup, CI tool installation, test speed
+  enforcement, repository configuration.
+- **i18n** — built-in translations for English, Bulgarian, German, Russian,
+  and Chinese; projects can extend with their own keys.
 
 ## Installation
 
@@ -26,21 +71,38 @@ Or add the registry to your `pip.conf` / `pyproject.toml` and install normally:
 pip install devx
 ```
 
-## Usage
+### Optional extras
 
-### CI/CD Automation
+devx ships optional dependency groups for different use cases:
 
-devx provides CI/CD modules invoked via `python -m devx.ci.*`:
+```bash
+pip install "devx[ci,lint]"      # CI runners and linting (pytest, ruff, pyright, bandit)
+pip install "devx[molecule]"     # Molecule testing for Ansible projects
+pip install "devx[dev]"          # Full local development (ci + lint + build + twine)
+```
+
+## Quick start
+
+After installing devx, set the required environment variables (see
+[Configuration](#configuration)) and invoke modules via `python -m devx.*` or
+the `devx` CLI.
+
+### CI/CD automation
+
+CI/CD modules are invoked via `python -m devx.ci.*`. Each module is also
+available as a `devx ci <command>` subcommand.
 
 ```bash
 # Release automation (versioning, changelog, tagging)
 python -m devx.ci.release
-python -m devx.ci.release --dry-run
+python -m devx.ci.release --dry-run          # preview without changes
+python -m devx.ci.release --verify           # check tag/version/changelog alignment
 
 # Publish a release to the Gitea PyPI registry
 python -m devx.ci.publish v1.0.0 oblachno-oss/devx
+python -m devx.ci.publish v1.0.0 oblachno-oss/devx --skip-build  # Gitea release only
 
-# Automated PR review
+# Automated PR review (posts inline comments and structured review)
 python -m devx.ci.pr_review 42 oblachno-oss/devx
 
 # Auto-merge a PR (validates title, squash-merges)
@@ -54,9 +116,11 @@ python -m devx.ci.sync_wiki --repo oblachno-oss/devx --strict
 
 # Generate and push quality badges
 python -m devx.ci.push_badges
+python -m devx.ci.push_badges --retries 3     # retry on git push failures
 
 # Check translation completeness
 python -m devx.ci.check_translations
+python -m devx.ci.check_translations --translations path/to/translations.json
 
 # Documentation coverage check
 python -m devx.ci.doc_coverage --fail-on-missing
@@ -64,56 +128,215 @@ python -m devx.ci.doc_coverage --fail-on-missing
 # Validate a commit message
 python -m devx.ci.validate_commit_msg commit-msg.txt --branch master
 
+# Detect whether the latest commit is a release commit
+python -m devx.ci.detect_release_commit
+
 # Notify on CI failure (creates a Gitea issue)
-python -m devx.ci.notify_failure --repo oblachno-oss/devx --run-id 123 --workflow ci --commit abc123
+python -m devx.ci.notify_failure --repo oblachno-oss/devx --run-id 123 \
+  --workflow ci --commit abc123 --auto-login
+
+# Discover available Gitea Actions runners
+python -m devx.ci.discover_runners --owner oblachno-oss --repo devx --indices
+
+# Distribute files across parallel runners (round-robin)
+python -m devx.ci.distribute_files --pattern "tests/integration/test_*.py" \
+  --runner-index 1 --max-runners 3 --github-env
+
+# Merge JUnit XML reports from parallel runners
+python -m devx.ci.merge_junit --pattern "junit-results/runner-*.xml" --output junit-merged.xml
+
+# Run pytest with cross-runner fail-fast and JUnit output
+python -m devx.ci.integration_guard --junit-output junit-results/runner-1.xml -- test_a.py test_b.py
 ```
 
-### Developer Tools
+### Developer tools
 
-devx provides developer tooling invoked via `python -m devx.tools.*`:
+Developer tooling modules are invoked via `python -m devx.tools.*` or the
+`devx tools <command>` subcommand.
 
 ```bash
-# Set up a development environment (venv, deps, hooks)
+# Set up a development environment (venv, deps, hooks, tea login)
 python -m devx.tools.setup --bin .venv/bin
+python -m devx.tools.setup --bin .venv/bin --extras "ci,lint" --no-pre-commit
 
 # Install CI tools (actionlint, git-cliff, act_runner, tea)
 python -m devx.tools.install_tools
 python -m devx.tools.install_tools --tool git-cliff --tool tea
+python -m devx.tools.install_tools --list
+
+# Install checkmake (Makefile linter)
+python -m devx.tools.install_checkmake
 
 # Check unit test speed
 python -m devx.tools.check_test_speed --max-seconds 10
+python -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
 
 # Configure repository (branch protection, labels)
-python -m devx.tools.configure_repo
+python -m devx.tools.configure_repo --repo devx --owner oblachno-oss
+
+# Generate badge SVG files locally
+python -m devx.tools.generate_badges --output-dir .badges/
+
+# Generate a cliff.toml with the correct task ID prefix
+python -m devx.tools.generate_cliff_config --prefix GRM
+python -m devx.tools.generate_cliff_config --prefix GRM --force  # overwrite existing
 ```
 
-### CLI
+### Molecule testing (optional)
 
-devx also provides a `devx` CLI command:
+For projects with Ansible roles, devx provides molecule testing helpers via
+`python -m devx.molecule.*` or `devx molecule <command>`.
+
+```bash
+# Distribute molecule scenarios across parallel runners
+python -m devx.molecule.distribute_molecule --runner-index 1 --max-runners 3
+python -m devx.molecule.distribute_molecule --list              # list all scenarios
+python -m devx.molecule.distribute_molecule --list-platforms    # list platforms
+
+# Run molecule tests with cross-runner fail-fast
+python -m devx.molecule.molecule_ci_guard --junit-output junit.xml pair1 pair2
+python -m devx.molecule.molecule_ci_guard --roles-root ansible/roles pair1 pair2
+
+# Run all molecule scenarios locally (sequential)
+python -m devx.molecule.molecule_all
+python -m devx.molecule.molecule_all --bin .venv/bin
+
+# Discover available Gitea Actions runners for molecule tests
+python -m devx.molecule.discover_runners --indices
+
+# Ensure Docker is available for molecule tests in CI
+python -m devx.molecule.start_docker
+```
+
+### OpenTofu helpers
+
+devx provides reusable functions for extracting values from `tofu output`:
+
+```python
+from devx.opentofu import get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field
+
+vms = get_tofu_output("customer_vms", cwd="tofu/environments/staging",
+                      env={"HCLOUD_TOKEN": token})
+ip = get_tofu_vm_ip("customer_vms", "oblachno", cwd="tofu/environments/staging",
+                    env={"HCLOUD_TOKEN": token})
+```
+
+## CLI commands overview
+
+devx provides a `devx` CLI command with three command groups:
 
 ```bash
 devx --help
 devx --version
 ```
 
-### Configuration
+### `devx ci` — CI/CD automation
 
-devx reads configuration from environment variables with `.env` file fallback:
+| Command | Description |
+|---------|-------------|
+| `devx ci auto-merge` | Squash-merge a PR with task ID validation |
+| `devx ci check-translations` | Check translation files for gaps and dead keys |
+| `devx ci classify-changes` | Classify git changes as user-facing or workflow-only |
+| `devx ci detect-release-commit` | Detect whether the latest commit is a release commit |
+| `devx ci discover-runners` | Discover available Gitea Actions runners |
+| `devx ci distribute-files` | Distribute files across parallel runners (round-robin) |
+| `devx ci doc-coverage` | Check documentation coverage for CLI commands and modules |
+| `devx ci integration-guard` | Run pytest with cross-runner fail-fast and JUnit output |
+| `devx ci merge-junit` | Merge JUnit XML reports from parallel runners |
+| `devx ci notify-failure` | Create a Gitea issue when a CI workflow fails |
+| `devx ci post-merge` | Update Vikunja task after a merge to master |
+| `devx ci pr-review` | Run automated PR review |
+| `devx ci publish` | Build package, publish to registry, create Gitea release |
+| `devx ci push-badges` | Generate badge SVG files and push to the badges branch |
+| `devx ci release` | Automated release: version, changelog, tag, push |
+| `devx ci sync-wiki` | Sync documentation from docs/ to the Gitea wiki |
+| `devx ci validate-commit-msg` | Validate commit messages for conventional format |
+
+### `devx tools` — Developer tools
+
+| Command | Description |
+|---------|-------------|
+| `devx tools check-test-speed` | Run unit tests and enforce execution-time budgets |
+| `devx tools configure-repo` | Configure branch protection and labels via Gitea API |
+| `devx tools generate-badges` | Generate self-contained SVG badge files |
+| `devx tools generate-cliff-config` | Generate a cliff.toml with the correct task ID prefix |
+| `devx tools install-checkmake` | Install checkmake (Makefile linter) |
+| `devx tools install-tools` | Install actionlint, git-cliff, act_runner, tea |
+| `devx tools setup` | Project setup: install deps, hooks, tea login |
+
+### `devx molecule` — Molecule testing (optional)
+
+| Command | Description |
+|---------|-------------|
+| `devx molecule all` | Run all molecule scenarios on all supported platforms |
+| `devx molecule discover-runners` | Discover available Gitea Actions runners |
+| `devx molecule distribute` | Distribute molecule test pairs across parallel runners |
+| `devx molecule guard` | Run molecule tests with CI failure polling |
+
+See [CLI Commands](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/CLI-Commands)
+in the wiki for full command documentation with examples.
+
+## Configuration
+
+devx reads configuration from environment variables with `.env` file fallback.
+The config system loads `.env` automatically via `python-dotenv`.
+
+### DEVX_ environment variables
 
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `DEVX_GITEA_API_URL` | `https://git.oblachno.oblachno.fyi/api/v1` | Gitea API base URL |
 | `DEVX_VIKUNJA_API_URL` | `https://work.oblachno.oblachno.fyi/api/v1` | Vikunja API base URL |
-| `DEVX_LANG` | `en` | Language (en, bg) |
+| `DEVX_REPO_OWNER` | **(none — must be set)** | Repository owner for API calls |
+| `DEVX_REPO_NAME` | **(none — must be set)** | Repository name (or `owner/repo`) |
+| `DEVX_TASK_PREFIX` | `DEVX` | Task ID prefix (GRM, OBL-INFRA, etc.) |
+| `DEVX_VIKUNJA_PROJECT_ID` | `6` | Vikunja project ID |
+| `DEVX_LANG` | `en` | Language for i18n (en, bg, de, ru, zh) |
+| `DEVX_TRANSLATIONS_PATH` | — | Path to a custom JSON translations file |
+| `DEVX_VERSION_FILE` | `src/devx/__init__.py` | Version source file (used by release) |
+| `DEVX_DOCS_DIR` | `docs` | Documentation directory (used by sync_wiki) |
+| `DEVX_STATUS_CHECKS` | `CI / quality (pull_request)` | Comma-separated status check contexts |
+| `DEVX_PYPI_REGISTRY_URL` | — | Gitea PyPI registry URL (used by publish) |
 | `REPO_TOKEN` | — | Gitea API token |
 | `VIKUNJA_TOKEN` | — | Vikunja API token |
+| `PYPI_TOKEN` | — | Standard PyPI token (takes precedence over Gitea registry) |
 
-Copy `.env.example` to `.env` and fill in your tokens:
+### Per-project overrides
+
+Projects using devx can override the default API URLs and language by setting
+`DEVX_*` environment variables or entries in their `.env` file. Copy
+`.env.example` to `.env` and fill in your tokens:
 
 ```bash
 cp .env.example .env
 ```
 
+### Change classification
+
+Projects configure which file paths are infrastructure (no release needed) vs
+user-facing (release needed) in `pyproject.toml`:
+
+```toml
+[tool.devx.classify]
+# Merge with DEFAULT_INFRASTRUCTURE (CI workflows, tests, docs, config)
+# use_defaults = true   # (default)
+
+# Project-specific infrastructure paths (merged with defaults)
+infrastructure = []
+
+# Files that would default to user-facing but are actually infrastructure
+infrastructure_overrides = [
+    "src/myproject/__init__.py",  # only contains __version__
+]
+
+# Safety override for broad infrastructure patterns
+user_facing_overrides = []
+
+# Tag patterns for CI conditional execution (orthogonal to release impact)
+[tool.devx.classify.tags]
+# ansible = ["ansible/**"]
+```
+
 ## Development
 
 ```bash
@@ -122,10 +345,86 @@ cd devx
 make setup         # Create venv, install deps, hooks, CI tools
 make lint-all      # ruff + pyright + bandit + actionlint
 make pytest-cov    # Unit tests with 100% coverage
+make test-unit     # Unit tests without coverage
+make workflow-check  # Static + dry-run validation of workflow YAML
+make clean         # Remove caches, build artifacts, coverage data
 ```
 
-See [AGENTS.md](AGENTS.md) for full project conventions, PR workflow, and architecture details.
+`make setup` automatically installs all development tools:
+- **Python deps** via `python -m devx.tools.setup` (pip install -e .[dev], pre-commit hooks)
+- **actionlint, git-cliff, act_runner, tea** via `python -m devx.tools.install_tools`
+- **tea CLI login** via `python -m devx.tools.setup` (configures `tea login` from `.env`)
+
+### Make targets
+
+| Target | Description |
+|--------|-------------|
+| `make setup` | Full local development setup (venv, deps, hooks, CI tools) |
+| `make setup-ci` | Lean setup for CI jobs (pytest + lint + runtime deps) |
+| `make setup-quality` | Setup for quality job (lint + test deps, actionlint) |
+| `make setup-release` | Setup for release jobs (git-cliff, tea, lint tools) |
+| `make install-tools` | Install actionlint, git-cliff, act_runner, tea |
+| `make install-hooks` | Install git hooks (pre-commit, pre-push) |
+| `make lint` | ruff check + ruff format check + pyright + bandit |
+| `make lint-ruff` | ruff check only |
+| `make lint-format` | ruff format check only |
+| `make typecheck` | pyright only |
+| `make lint-bandit` | bandit security scan only |
+| `make lint-all` | lint + workflow-lint (actionlint) |
+| `make lint-deps` | pip-audit dependency vulnerability scan |
+| `make test-unit` | Unit tests without coverage |
+| `make pytest-cov` | Unit tests with 100% coverage enforcement |
+| `make workflow-lint` | actionlint on .gitea/workflows/*.yml |
+| `make workflow-dryrun` | act_runner exec --dryrun on all workflows |
+| `make workflow-check` | workflow-lint + workflow-dryrun |
+| `make clean` | Remove caches, build artifacts, coverage data |
+
+See [AGENTS.md](AGENTS.md) for full project conventions, PR workflow, and
+architecture details.
+
+## Architecture overview
+
+devx is a self-contained Python package under `src/devx/`. It never imports
+from scripts outside the package. All tools are invoked via
+`python -m devx.ci.*`, `python -m devx.tools.*`, or `python -m devx.molecule.*`.
+
+```
+src/devx/
+├── __init__.py          # Version (single source of truth, read by setuptools)
+├── cli.py               # Click-based CLI entry point (devx command)
+├── config.py            # Configuration system (DEVX_ env vars, .env loading)
+├── api_clients.py       # GiteaClient, VikunjaClient — HTTP API wrappers
+├── gitea_cli.py         # TeaCLI — wrapper around tea CLI with JSON parsing
+├── i18n.py              # Translation system (gettext-based, translations.json)
+├── exceptions.py        # Custom exception types (DevxError, APIError)
+├── opentofu.py          # OpenTofu output helpers
+├── translations.json    # Translation strings (en, bg, de, ru, zh)
+├── ci/                  # CI/CD automation modules (run by workflows)
+├── tools/               # Developer tooling modules (run locally or by CI)
+└── molecule/            # Optional molecule testing helpers (for Ansible projects)
+```
+
+### Design principles
+
+- **Self-contained package** — `src/devx/` never imports from scripts outside the package
+- **Module-based invocation** — All tools invoked via `python -m devx.ci.*` or `python -m devx.tools.*`
+- **PYTHONPATH: src** — Workflows set `PYTHONPATH: src` (not `.:src` since there are no scripts at repo root)
+- **Config via env vars** — `DEVX_*` environment variables with `.env` file fallback
+- **100% test coverage** — enforced by `--cov-fail-under=100`
+- **i18n by default** — all user-facing strings wrapped in `_()` for translation
+
+See [Architecture](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/Architecture)
+and [CI/CD Workflow](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/CI-CD-Workflow)
+in the wiki for detailed documentation.
+
+## Links
+
+- **Wiki**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+- **Releases**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+- **Actions**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+- **Source**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx](https://git.oblachno.oblachno.fyi/oblachno-oss/devx)
+- **GRM (origin project)**: [https://git.oblachno.oblachno.fyi/oblachno-oss/grm](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
 
 ## License
 
-GPL-3.0
+GPL-3.0 — see [LICENSE](LICENSE).

docs/index.md

@@ -1,10 +1,48 @@
 # devx — Reusable Development & CI/CD Tools
 
-A Python package providing reusable development and CI/CD automation tools for oblachno-oss projects.
+A Python package providing reusable development and CI/CD automation tools for
+oblachno-oss projects. devx consolidates release management, PR automation,
+wiki sync, badge generation, translation checks, documentation coverage,
+parallel test distribution, and more into a single installable package.
+
+It was extracted from the [GRM](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
+project to be reusable across all oblachno-oss repositories.
+
+> An open-source project from **Oblachno** (облачно means *cloudy* in Bulgarian).
+
+[![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/389da2176541841d5dcf3f75f3bd03cbf9403830/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
-devx consolidates release management, PR automation, wiki sync, badge generation, translation checks, and more into a single installable package. It was extracted from the [GRM](https://git.oblachno.oblachno.fyi/oblachno-oss/grm) project to be reusable across all oblachno-oss projects.
+devx provides a complete, opinionated CI/CD pipeline for any project hosted on
+a Gitea instance with Gitea Actions. Install the package, declare configuration
+via environment variables and `pyproject.toml`, and inherit:
+
+- **Automated releases** — git-cliff-driven semver versioning, changelog
+  generation, tagging, and publishing to a Gitea PyPI registry.
+- **PR automation** — squash-merge with task ID validation, automated PR
+  review with inline comments, and conventional commit enforcement.
+- **Smart change classification** — user-facing vs workflow-only change
+  detection so infrastructure-only changes skip releases.
+- **Documentation sync** — push `docs/` markdown to the Gitea wiki with
+  integrity verification.
+- **Quality badges** — self-contained SVG badges for coverage, tests, docs,
+  quality, version, and Python version.
+- **Translation checks** — validate i18n keys against source code, detect
+  dead keys and missing languages.
+- **Parallel test distribution** — split test files or molecule scenarios
+  across CI runners with cross-runner fail-fast.
+- **Developer tools** — environment setup, CI tool installation, test speed
+  enforcement, repository configuration.
+- **i18n** — built-in translations for English, Bulgarian, German, Russian,
+  and Chinese; projects can extend with their own keys.
 
 ## Installation
 
@@ -14,11 +52,92 @@ Install from the Gitea PyPI registry:
 pip install devx --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
 ```
 
+Optional extras:
+
+```bash
+pip install "devx[ci,lint]"      # CI runners and linting
+pip install "devx[molecule]"     # Molecule testing for Ansible projects
+pip install "devx[dev]"          # Full local development
+```
+
 ## Architecture
 
-- **Core modules** — config, exceptions, i18n, api_clients, gitea_cli
-- **CI automation** (`devx.ci`) — release, publish, auto_merge, pr_review, classify_changes, etc.
-- **Dev tools** (`devx.tools`) — setup, install_tools, check_test_speed, configure_repo, generate_badges
-- **Molecule tools** (`devx.molecule`) — Optional, for projects with Ansible roles
+devx is a self-contained Python package under `src/devx/`:
 
-See [AGENTS.md](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/AGENTS.md) for full project conventions.
+- **Core modules** — `config.py`, `exceptions.py`, `i18n.py`, `api_clients.py`,
+  `gitea_cli.py`, `cli.py`, `opentofu.py`
+- **CI automation** (`devx.ci`) — release, publish, auto_merge, pr_review,
+  classify_changes, sync_wiki, push_badges, check_translations, doc_coverage,
+  validate_commit_msg, detect_release_commit, notify_failure, post_merge,
+  discover_runners, distribute_files, merge_junit, integration_guard
+- **Dev tools** (`devx.tools`) — setup, install_tools, check_test_speed,
+  configure_repo, generate_badges, generate_cliff_config, install_checkmake
+- **Molecule tools** (`devx.molecule`) — Optional, for projects with Ansible
+  roles: distribute_molecule, molecule_ci_guard, molecule_all, discover_runners,
+  start_docker, platforms
+
+See [Architecture](Architecture) for the full package structure, module
+descriptions, design principles, and data flow diagrams.
+
+## CI/CD pipeline
+
+devx uses Gitea Actions with three workflows:
+
+- **CI** (`ci.yml`) — runs on pull requests: quality checks, change detection,
+  release dry-run, automated PR review, and auto-merge.
+- **Post-merge** (`post-merge.yml`) — runs on every push to master: release
+  versioning, wiki sync, badge generation, Vikunja task updates, and repo
+  configuration.
+- **Publish** (`publish.yml`) — runs on tag pushes: builds the package,
+  publishes to the Gitea PyPI registry, and creates a Gitea release.
+
+See [CI/CD Workflow](CI-CD-Workflow) for the full pipeline documentation,
+including the post-merge job graph, release process, badge generation, and
+wiki sync details.
+
+## CLI commands
+
+devx provides a `devx` CLI with three command groups:
+
+- `devx ci <command>` — CI/CD automation (17 commands)
+- `devx tools <command>` — Developer tools (7 commands)
+- `devx molecule <command>` — Molecule testing (4 commands, optional)
+
+See [CLI Commands](CLI-Commands) for full command documentation with examples.
+
+## Configuration
+
+devx reads configuration from `DEVX_*` environment variables with `.env` file
+fallback. Key variables:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `DEVX_GITEA_API_URL` | `https://git.oblachno.oblachno.fyi/api/v1` | Gitea API base URL |
+| `DEVX_VIKUNJA_API_URL` | `https://work.oblachno.oblachno.fyi/api/v1` | Vikunja API base URL |
+| `DEVX_REPO_OWNER` | **(must be set)** | Repository owner |
+| `DEVX_REPO_NAME` | **(must be set)** | Repository name |
+| `DEVX_TASK_PREFIX` | `DEVX` | Task ID prefix (GRM, OBL-INFRA, etc.) |
+| `DEVX_LANG` | `en` | Language for i18n (en, bg, de, ru, zh) |
+| `REPO_TOKEN` | — | Gitea API token |
+| `VIKUNJA_TOKEN` | — | Vikunja API token |
+
+See [AGENTS.md](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/AGENTS.md)
+for the full configuration reference, PR workflow, and project conventions.
+
+## Wiki pages
+
+- [Home](Home) — This page
+- [CLI Commands](CLI-Commands) — Full CLI command documentation with examples
+- [Architecture](Architecture) — Package structure, module descriptions, design principles
+- [CI/CD Workflow](CI-CD-Workflow) — Pipeline documentation, workflows, and CI scripts
+
+## Links
+
+- **Source**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx](https://git.oblachno.oblachno.fyi/oblachno-oss/devx)
+- **Releases**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+- **Actions**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+- **GRM (origin project)**: [https://git.oblachno.oblachno.fyi/oblachno-oss/grm](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
+
+## License
+
+GPL-3.0

docs/tech/architecture.md

@@ -1,50 +1,592 @@
 # Architecture
 
-devx is a reusable Python package providing development and CI/CD tools for oblachno-oss projects.
+devx is a reusable Python package providing development and CI/CD tools for
+oblachno-oss projects. It is self-contained under `src/devx/` and never imports
+from scripts outside the package.
 
-## Package Structure
+## Package structure
 
 ```
 src/devx/
-├── __init__.py          # Version (single source of truth)
-├── cli.py               # Click-based CLI entry point (devx command)
-├── config.py            # Configuration system (DEVX_ env vars)
-├── api_clients.py       # GiteaClient, VikunjaClient — HTTP API wrappers
-├── gitea_cli.py         # TeaCLI — wrapper around tea CLI with JSON parsing
-├── i18n.py              # Translation system (gettext-based, translations.json)
-├── exceptions.py        # Custom exception types (DevxError, APIError)
-├── translations.json    # Translation strings (en, bg, de, ru, zh)
-├── ci/                  # CI/CD automation modules
-├── tools/               # Developer tooling modules
-└── molecule/            # Optional molecule testing helpers
+├── __init__.py              # Version (single source of truth, read by setuptools)
+├── cli.py                   # Click-based CLI entry point (devx command)
+├── config.py                # Configuration system (DEVX_ env vars, .env loading)
+├── api_clients.py           # GiteaClient, VikunjaClient — HTTP API wrappers
+├── gitea_cli.py             # TeaCLI — wrapper around tea CLI with JSON parsing
+├── i18n.py                  # Translation system (JSON-based, translations.json)
+├── exceptions.py            # Custom exception types (DevxError, APIError)
+├── opentofu.py              # OpenTofu output helpers
+├── translations.json        # Translation strings (en, bg, de, ru, zh)
+├── ci/                      # CI/CD automation modules (run by workflows)
+│   ├── __init__.py
+│   ├── _shared.py           # Shared utilities (get_latest_tag)
+│   ├── release.py           # Automated versioning, tagging, changelog
+│   ├── publish.py           # Build and publish to Gitea PyPI registry
+│   ├── auto_merge.py        # Squash-merge PRs with task ID validation
+│   ├── classify_changes.py  # User-facing vs workflow-only change detection
+│   ├── detect_release_commit.py  # Detect release commits on master
+│   ├── validate_commit_msg.py    # Conventional commit validation
+│   ├── pr_review.py         # Automated PR review
+│   ├── post_merge.py        # Vikunja task updates after merge
+│   ├── sync_wiki.py         # Sync documentation to Gitea wiki
+│   ├── push_badges.py       # Generate and push quality badges
+│   ├── notify_failure.py    # Create Gitea issues on CI failures
+│   ├── merge_junit.py       # Merge JUnit XML reports from parallel runners
+│   ├── distribute_files.py  # Distribute files across parallel runners
+│   ├── integration_guard.py # Run pytest with cross-runner fail-fast + JUnit
+│   ├── discover_runners.py  # Dynamic Gitea runner discovery
+│   ├── check_translations.py  # Translation completeness check
+│   └── doc_coverage.py      # Documentation coverage check
+├── tools/                   # Developer tooling modules (run locally or by CI)
+│   ├── __init__.py
+│   ├── setup.py             # Environment setup (venv, deps, hooks, tea login)
+│   ├── install_tools.py     # Install actionlint, git-cliff, act_runner, tea
+│   ├── check_test_speed.py  # Measure unit test execution time
+│   ├── configure_repo.py    # Branch protection and label setup
+│   ├── generate_badges.py   # Badge SVG generation
+│   ├── generate_cliff_config.py  # Generate cliff.toml with correct prefix
+│   └── install_checkmake.py # Install checkmake (Makefile linter)
+└── molecule/                # Optional molecule testing helpers (Ansible projects)
+    ├── __init__.py
+    ├── discover_runners.py      # Dynamic Gitea runner discovery
+    ├── distribute_molecule.py   # Distribute scenarios across runners
+    ├── molecule_ci_guard.py     # Run molecule with cross-runner fail-fast
+    ├── molecule_all.py          # Run all molecule scenarios locally
+    ├── start_docker.py          # Ensure Docker is available for molecule
+    └── platforms.py             # Supported molecule platforms
 ```
 
-## Core Modules
+## Core modules
 
-### cli.py
+### `__init__.py`
 
-Click-based CLI entry point. Provides three command groups: `devx ci`, `devx tools`, `devx molecule`. Each subcommand delegates to the corresponding module via `_run_module()`.
+Contains only `__version__`, the single source of truth for the package
+version. Read by setuptools via `dynamic = ["version"]` in `pyproject.toml`.
+Updated automatically by `devx.ci.release` during the release process. Treated
+as infrastructure (not user-facing) by the change classifier since it is a
+release artifact, not user code.
 
-### i18n.py
+### `cli.py`
 
-Simple i18n system using a JSON translations file. Supports en, bg, de, ru, zh. Projects can extend translations by setting `DEVX_TRANSLATIONS_PATH` to a custom JSON file.
+Click-based CLI entry point. Provides three command groups: `devx ci`,
+`devx tools`, and `devx molecule`. Each subcommand delegates to the
+corresponding module via `_run_module()`, which imports the module, sets
+`sys.argv`, and calls its `main()` function. This design keeps all logic in
+the modules themselves — `cli.py` is purely a router.
 
-### exceptions.py
+The CLI is registered as a console script via `pyproject.toml`:
+```toml
+[project.scripts]
+devx = "devx.cli:cli"
+```
 
-Custom exception hierarchy: `DevxError` (base), `APIError` (HTTP errors with status code and message).
+### `config.py`
 
-### api_clients.py
+Shared configuration constants for all devx modules. All defaults can be
+overridden via environment variables with the `DEVX_` prefix. Provides:
 
-HTTP API clients with connection pooling and retry logic:
-- `GiteaClient` — Gitea REST API (branch protection, labels, issues, PRs, releases, reviews)
-- `VikunjaClient` — Vikunja REST API (tasks, projects, comments)
+- `GITEA_API_URL` / `VIKUNJA_API_URL` — API endpoints
+- `REPO_OWNER` — repository owner (must be set per-project)
+- `TASK_PREFIX` / `TASK_ID_RE` — task ID prefix and regex (e.g., `DEVX-N`)
+- `VIKUNJA_PROJECT_ID` — Vikunja project for task tracking
+- `DEFAULT_TIMEOUT`, `DEFAULT_PER_PAGE` — HTTP client defaults
+- `MAX_RETRIES`, `RETRY_BACKOFF_BASE`, `RETRY_STATUS_CODES` — retry config
+- `CONVENTIONAL_RE` — conventional commit format regex
 
-Both clients retry on transient errors (429, 5xx, connection errors) with exponential backoff.
+### `exceptions.py`
 
-### config.py
+Custom exception hierarchy:
 
-Configuration constants with env-var overrides (`DEVX_` prefix). Includes API URLs, timeouts, retry settings, task prefix regex, and conventional commit regex.
+- `DevxError` — base exception for all devx errors
+- `APIError(DevxError)` — raised when a REST API call returns an HTTP error.
+  Carries `status` (HTTP status code) and `message` (error message).
 
-### gitea_cli.py
+### `i18n.py`
 
-Python wrapper around the `tea` Gitea CLI tool. Parses JSON output for structured data. Used by CI scripts for Gitea API operations (issues, labels, PRs, releases, reviews).
+Simple i18n system using a JSON translations file (`translations.json`).
+Supports five languages: `en`, `bg`, `de`, `ru`, `zh`. The `_()` function
+wraps user-facing strings for translation.
+
+Projects can extend translations by setting `DEVX_TRANSLATIONS_PATH` to a
+custom JSON file. Keys from the project's file are merged on top of devx's
+built-in translations, allowing projects to override or add keys without
+modifying the package.
+
+### `api_clients.py`
+
+Reusable HTTP API clients with connection pooling and retry logic. Both
+clients retry on transient errors (429, 5xx, connection errors) with
+exponential backoff (2s, 4s, 8s).
+
+**`GiteaClient`** — Gitea REST API wrapper:
+- Branch protection (get, create, update)
+- Labels (list, create, add to issues)
+- Issues (create, list)
+- Pull requests (get commits, merge, create review)
+- Releases (list)
+- Wiki pages (list, fetch, create, update, delete)
+
+**`VikunjaClient`** — Vikunja REST API wrapper:
+- Tasks (list project tasks, get, update, mark done)
+- Comments (create)
+
+### `gitea_cli.py`
+
+Thin Python wrapper around the `tea` Gitea CLI tool. Parses JSON output for
+structured data. Used by CI scripts for Gitea API operations that tea handles
+well, avoiding hand-rolled HTTP requests.
+
+**`TeaCLI`** operations:
+- `create_issue()` — Create issues with labels
+- `list_labels()` / `create_label()` / `add_label()` — Label management
+- `create_pr()` / `merge_pr()` / `review_pr()` — Pull request operations
+- `create_release()` / `list_releases()` — Release management
+- `list_branches()` — Branch listing
+
+Operations NOT supported via tea (still use `GiteaClient`):
+- Wiki page management
+- Commit status checks
+- Runner discovery
+- PR file/commit listing (tea has limited support)
+- Branch protection with detailed config
+
+### `opentofu.py`
+
+OpenTofu output helpers for CI/CD deployment scripts. Provides reusable
+functions for extracting values from `tofu output` in a structured way,
+eliminating duplicated `subprocess.run` boilerplate:
+
+- `get_tofu_output(output_name, cwd, env)` — Run `tofu output -json` and return parsed JSON
+- `get_tofu_vm_ip(output_name, vm_name, cwd, env)` — Extract a VM's IP address
+- `get_tofu_vm_field(output_name, vm_name, field, cwd, env)` — Extract a VM field
+
+## CI/CD modules (`devx.ci`)
+
+Modules in this package are run by Gitea Actions workflows. They may import
+from `devx.api_clients`, `devx.config`, `devx.gitea_cli`, and `devx.i18n`.
+
+### `release.py`
+
+Automated release using git-cliff. Calculates the next semver version from
+conventional commits since the last tag, updates `__version__` in
+`__init__.py` and `CHANGELOG.md`, runs lint and tests to verify the release
+is healthy, commits with `release: vX.Y.Z [skip ci]`, creates an annotated
+tag, and pushes both to master.
+
+Idempotent: if there are no new conventional commits since the last tag, it
+exits without doing anything. If the tag already exists, it skips tag creation
+and only pushes. Includes a `--verify` mode that checks tag/version/changelog
+alignment without making changes.
+
+### `publish.py`
+
+Builds the Python package with `python -m build`, publishes to a Gitea PyPI
+registry (or standard PyPI if `PYPI_TOKEN` is set), and creates a Gitea
+release with git-cliff-generated notes. Supports `--skip-build` for non-Python
+repos that only need a Gitea release.
+
+### `auto_merge.py`
+
+Auto-merges a PR when all CI checks pass. Reads the task ID from the branch
+name (falling back to `.taskid` file), validates the PR title format against
+the Vikunja task title, extracts the conventional commit message from PR
+commits, and squash-merges with title `{PREFIX}-N <conventional commit>`.
+
+If the head branch is behind master (HTTP 405), it automatically pulls master,
+rebases, force-pushes, and retries the merge.
+
+### `classify_changes.py`
+
+Classifies git changes between two refs as user-facing or workflow-only. Uses
+a layered rule system configured in `pyproject.toml` under
+`[tool.devx.classify]`:
+
+1. **User-facing overrides** (highest priority — safety override)
+2. **Infrastructure overrides** (explicit per-file)
+3. **Infrastructure patterns** (DEFAULT_INFRASTRUCTURE + project-specific)
+4. **Default**: user-facing (safe default — any unknown file triggers release)
+
+Also supports custom tags (orthogonal to release impact) for CI conditional
+execution (e.g., `ansible` tag to trigger molecule tests).
+
+### `pr_review.py`
+
+Automated PR review. Fetches the PR diff via the Gitea API and runs a series
+of checks, posting a structured review with `COMMENT` (no issues) or
+`REQUEST_CHANGES` (issues found):
+
+- Architecture compliance (no subprocess in CLI, no hardcoded URLs)
+- Best practices (no `print()`, no bare `except`, no `TODO`/`FIXME`, no
+  functions > 50 lines)
+- Security (no hardcoded secrets, no `shell=True`, no `eval`/`exec`)
+- i18n (no raw strings in `click.echo()` without `_()` wrapper)
+- Resource management (no `open()` without `with`, no `Popen()` without cleanup)
+- Documentation (source changes must include doc updates)
+- Test coverage (source changes must include test updates)
+- Commit conventions (conventional commit format on PR commits)
+
+### `sync_wiki.py`
+
+Syncs documentation from `docs/` to the Gitea wiki via the API. Reads
+`docs/mapping.json` to map file paths to wiki page titles, then creates or
+updates pages. Supports `--dry-run`, `--verify` (check content), and
+`--strict` (full integrity check: page count, missing pages, stale pages,
+content match).
+
+### `push_badges.py`
+
+Generates SVG badge files using `devx.tools.generate_badges`, pushes them to
+an orphan `badges` branch, and updates `README.md` and `docs/index.md` on
+master with cache-busting `raw/commit/<sha>/badge.svg` URLs (Gitea caches
+`raw/branch/` URLs for 6 hours). Fetches latest master before generating
+badges so the version badge reflects the current state. Supports `--retries`
+for retrying on git push failures.
+
+### `notify_failure.py`
+
+Creates a Gitea issue when a CI workflow fails. Uses the `tea` CLI for issue
+creation with failure labels. Supports `--auto-login` to configure the tea
+CLI login profile from `REPO_TOKEN` and `DEVX_GITEA_API_URL` before creating
+the issue.
+
+### `post_merge.py`
+
+Updates the Vikunja task after a merge to master. Extracts the task ID from
+the commit message, marks the task as done, and posts a comment with the
+merge SHA.
+
+### `validate_commit_msg.py`
+
+Validates commit messages. On feature branches: conventional commits only
+(no `{PREFIX}-N` prefix). On master: must have `{PREFIX}-N` prefix from
+auto-merge, followed by a conventional commit message.
+
+### `detect_release_commit.py`
+
+Detects whether the latest git commit is a release commit
+(`release: vX.Y.Z [skip ci]`). Writes `is-release=true` or `is-release=false`
+to `$GITHUB_OUTPUT` for use in CI workflow conditionals.
+
+### `check_translations.py`
+
+Validates translation files against the Python source code. Checks for
+missing keys (used in code but not in translations), dead keys (defined but
+not used), and missing languages (a key exists but is missing one of the five
+supported languages). Supports checking additional translation sets via
+`--translations`.
+
+### `doc_coverage.py`
+
+Checks documentation coverage for CLI commands and major modules. Parses
+Click commands from `cli.py` and verifies each has documentation in
+`docs/user/cli-commands.md`. Checks that core modules are documented in
+`architecture.md` and CI scripts in `ci-cd-workflow.md`. Supports
+`--fail-on-missing` to enforce 100% coverage.
+
+### `discover_runners.py`
+
+Discovers available Gitea Actions runners at three levels: repository,
+organization, and instance (admin). Falls back to the `MOLECULE_RUNNERS` repo
+variable or `DEFAULT_MAX_RUNNERS` (3). Outputs runner count or a JSON index
+array for use as a dynamic matrix in Gitea Actions.
+
+### `distribute_files.py`
+
+Distributes files matching a glob pattern across N parallel runners
+(round-robin). Writes the assigned file list for the current runner to
+`$GITHUB_ENV`. Used for splitting test suites across CI runners.
+
+### `merge_junit.py`
+
+Merges JUnit XML reports from parallel matrix runners into a single
+consolidated report. Exit code is non-zero if any merged suite reports
+failures, making it suitable as a CI gating step.
+
+### `integration_guard.py`
+
+Runs pytest with the same cross-runner failure detection mechanism used by
+`molecule_ci_guard`. If any other integration-tests matrix runner reports
+failure, the current pytest subprocess is killed and this runner exits early.
+Generates JUnit XML via pytest's `--junitxml` flag.
+
+## Developer tools (`devx.tools`)
+
+Modules in this package are run locally or by CI setup jobs. They may import
+from `devx.api_clients`, `devx.config`, and `devx.gitea_cli`.
+
+### `setup.py`
+
+Project setup: installs Python dependencies (editable mode with extras),
+Ansible Galaxy collections (if `ansible/requirements.yml` exists), pre-commit
+hooks (pre-commit, commit-msg, pre-push), and configures the `tea` CLI login
+profile from `.env`. Supports `--extras` to specify dependency groups,
+`--no-pre-commit` to skip hook installation, and `--no-tea-login` to skip tea
+configuration.
+
+### `install_tools.py`
+
+Installs CI/CD development tools that are not Python packages: actionlint,
+git-cliff, act_runner, and tea. Each tool is installed to `~/.local/bin` if
+not already on PATH. Idempotent: skips tools that are already available.
+Supports `--tool` to install specific tools and `--list` to show status.
+
+### `check_test_speed.py`
+
+Runs unit tests and enforces execution-time budgets. Two quality gates:
+total suite time must not exceed `--max-seconds` (default: 10s), and no
+individual test may exceed `--max-single-seconds` (default: 0.5s, 0 to
+disable). Runs `make test-unit` with `PYTEST_ADDOPTS=--durations=0`.
+
+### `configure_repo.py`
+
+Configures repository branch protection and labels via the Gitea REST API.
+Sets up master branch protection (required status checks, block on rejected
+reviews, block on outdated branch) and creates standard labels. Status check
+contexts are read from `DEVX_STATUS_CHECKS` or default to
+`CI / quality (pull_request)`.
+
+### `generate_badges.py`
+
+Generates self-contained SVG badge files from project metrics. Runs
+pytest-cov, doc-coverage, lint checks, and version extraction, then writes
+SVG files that can be served as static files from the Gitea raw file API.
+Badges generated: coverage, tests, docs, quality, version, python.
+
+### `generate_cliff_config.py`
+
+Generates a `cliff.toml` configuration file with the correct task ID prefix
+preprocessor. Eliminates the need to manually duplicate and maintain
+`cliff.toml` across repos that use devx. Supports `--prefix` to set the task
+ID prefix and `--force` to overwrite an existing file.
+
+### `install_checkmake.py`
+
+Installs checkmake (Makefile linter) if not already present. Tries
+`go install` first if Go is available, otherwise downloads the latest
+pre-built Linux binary from the official GitHub releases.
+
+## Molecule modules (`devx.molecule`)
+
+Optional modules for projects with Ansible roles. Requires the `molecule`
+extra (`pip install devx[molecule]`).
+
+### `distribute_molecule.py`
+
+Distributes molecule (scenario, platform) pairs across N parallel runners.
+Discovers scenarios under `ansible/roles/*/molecule/` and crosses them with
+the supported OS platform matrix. Supports `--roles-root` for multi-role
+repositories, `--list` to list scenarios, and `--list-platforms` to list
+platforms.
+
+### `molecule_ci_guard.py`
+
+Runs molecule tests sequentially while polling the Gitea API for other runner
+failures. If any other molecule matrix runner reports failure, the current
+molecule subprocess is killed and this runner exits early. Generates JUnit
+XML when `--junit-output` is provided. Supports both single-role (4-part) and
+multi-role (5-part) pair encoding.
+
+### `molecule_all.py`
+
+Runs all molecule scenarios on all supported OS platforms sequentially.
+Intended for local development; CI uses the parallel matrix instead.
+
+### `discover_runners.py`
+
+Discovers available Gitea Actions runners for molecule tests. Same logic as
+`devx.ci.discover_runners` but intended for molecule-specific workflows.
+
+### `start_docker.py`
+
+Ensures Docker is available for molecule tests in CI. Verifies Docker is
+accessible and sets `DOCKER_HOST` explicitly. If the host socket is not
+available, tries the rootless socket, then starts a local `dockerd` with the
+vfs storage driver (requires privileged container).
+
+### `platforms.py`
+
+Single source of truth for the supported OS platform matrix. Each entry maps
+a short name to (image, command). Uses the project's pre-built
+molecule-test-base image with `sleep infinity` (not systemd) to avoid cgroup
+v2 failures. Supports loading custom platforms from a JSON file.
+
+## Design principles
+
+- **Self-contained package** — `src/devx/` never imports from scripts outside
+  the package. This allows devx to be installed and used as a dependency
+  without requiring a specific repo layout in the consumer.
+- **Module-based invocation** — All tools invoked via `python -m devx.ci.*`,
+  `python -m devx.tools.*`, or `python -m devx.molecule.*`. The `devx` CLI is
+  a thin router that delegates to module `main()` functions.
+- **PYTHONPATH: src** — Workflows set `PYTHONPATH: src` (not `.:src` since
+  there are no scripts at repo root). The `src` directory is the sole import
+  root.
+- **Config via env vars** — `DEVX_*` environment variables with `.env` file
+  fallback. Projects override defaults via environment or `.env`, never by
+  editing package code.
+- **100% test coverage** — enforced by `--cov-fail-under=100` in pytest.
+- **i18n by default** — all user-facing strings wrapped in `_()` for
+  translation. Five languages supported out of the box.
+- **Safe-by-default classification** — any file that doesn't match an
+  infrastructure pattern defaults to user-facing, triggering a release. This
+  prevents new file types from accidentally skipping releases.
+- **Secrets via environment** — secrets are passed via environment variables,
+  never on the command line.
+
+## Import rules
+
+1. **`src/devx/` is self-contained** — the package never imports from outside `src/`
+2. **CI modules** (`devx.ci.*`) may import from `devx.api_clients`,
+   `devx.config`, `devx.gitea_cli`, `devx.i18n`
+3. **Tool modules** (`devx.tools.*`) may import from `devx.api_clients`,
+   `devx.config`, `devx.gitea_cli`
+4. **Cross-module imports** within `devx.ci.*` or `devx.tools.*` are allowed
+   but must be documented (e.g., `release.py` imports from
+   `classify_changes.py`)
+
+## Data flow
+
+### PR lifecycle
+
+```
+Developer creates Vikunja task (DEVX-N)
+    │
+    ▼
+Developer creates branch (DEVX-N-short-description)
+    │
+    ▼
+Developer commits (conventional commits, no DEVX-N prefix)
+    │
+    ▼
+Developer pushes and creates PR (title: "DEVX-N: <vikunja task title>")
+    │
+    ▼
+CI workflow (ci.yml) triggers:
+    │
+    ├── quality (lint, tests, coverage, test speed, doc coverage,
+    │            translation check, dependency scan, workflow dry-run)
+    │
+    ├── detect-changes (classify_changes.py → user-facing or workflow-only)
+    │       └── if user-facing → release-dry-run (release.py --dry-run)
+    │
+    ├── pr-review (pr_review.py → posts COMMENT or REQUEST_CHANGES)
+    │
+    └── auto-merge (auto_merge.py)
+            ├── validate PR title format
+            ├── validate PR title matches Vikunja task title
+            ├── extract conventional commit message from PR commits
+            ├── squash-merge with "DEVX-N <conventional commit>" title
+            └── push to master
+                    │
+                    ▼
+            Post-merge workflow triggers (see below)
+```
+
+### Post-merge flow
+
+```
+Push to master (squash-merge commit: "DEVX-N <conventional commit>")
+    │
+    ▼
+Post-merge workflow (post-merge.yml) triggers:
+    │
+    ├── detect-type (detect_release_commit.py)
+    │       └── is-release? → skip all jobs except badges
+    │
+    ├── validate-commit-msg (validate_commit_msg.py --branch master)
+    │
+    ├── release (release.py)
+    │       ├── classify_changes.py → skip if workflow-only
+    │       ├── git-cliff → calculate next version
+    │       ├── update __version__ in __init__.py
+    │       ├── update CHANGELOG.md
+    │       ├── run make lint-ruff && make pytest-cov
+    │       ├── commit "release: vX.Y.Z [skip ci]"
+    │       ├── create annotated tag vX.Y.Z
+    │       └── push commit + tag to master
+    │               │
+    │               ▼
+    │       Tag push triggers publish workflow (see below)
+    │
+    ├── sync-wiki (sync_wiki.py --strict)
+    │       └── sync docs/ to Gitea wiki with integrity check
+    │
+    ├── badges (push_badges.py) [ALWAYS runs, even on release commits]
+    │       ├── fetch latest master
+    │       ├── generate_badges.py → SVG files
+    │       ├── push to orphan badges branch
+    │       └── update README.md + docs/index.md with cache-busting URLs
+    │
+    ├── vikunja (post_merge.py)
+    │       ├── extract task ID from commit message
+    │       ├── mark Vikunja task as done
+    │       └── post comment with merge SHA
+    │
+    └── configure-repo (configure_repo.py)
+            └── ensure branch protection and labels
+```
+
+### Publish flow
+
+```
+Tag push (vX.Y.Z) triggers publish workflow (publish.yml):
+    │
+    ▼
+    ├── install build, twine, git-cliff, tea
+    ├── configure tea login
+    │
+    └── publish (publish.py)
+            ├── build package (python -m build)
+            ├── publish to Gitea PyPI registry (twine upload)
+            │   OR publish to standard PyPI (if PYPI_TOKEN set)
+            │   OR skip publish (if --skip-build)
+            └── create Gitea release with git-cliff notes
+```
+
+### Badge generation flow
+
+```
+push_badges.py:
+    │
+    ├── fetch_latest_master() → git fetch + reset --hard origin/master
+    │
+    ├── generate_badges() → devx.tools.generate_badges
+    │       ├── run pytest-cov → parse coverage %
+    │       ├── run pytest → parse test count
+    │       ├── run doc_coverage → parse doc coverage %
+    │       ├── run lint → quality status
+    │       ├── read __version__ from __init__.py
+    │       └── write SVG files to .badges/
+    │
+    ├── push_to_badges_branch()
+    │       ├── git checkout --orphan badges
+    │       ├── git rm -rf .
+    │       ├── copy SVG files to root
+    │       ├── git commit "Update badges [skip ci]"
+    │       ├── git push origin badges --force
+    │       └── return commit SHA
+    │
+    └── update_readme_with_badge_sha()
+            ├── git checkout master
+            ├── replace raw/branch/badges/ URLs with raw/commit/<sha>/ URLs
+            ├── git commit "chore: update badge URLs [skip ci]"
+            └── git push origin master
+```
+
+## tea CLI integration
+
+The `tea` Gitea CLI tool is used for Gitea API interactions where tea provides
+reliable, official support. It is installed by
+`python -m devx.tools.install_tools` and configured by
+`python -m devx.tools.setup` (login profile from `.env` `REPO_TOKEN`).
+
+`devx.gitea_cli.TeaCLI` wraps tea with JSON output parsing. Operations that
+tea does not support (wiki management, commit status, runner discovery,
+detailed branch protection) fall back to `GiteaClient` (direct HTTP).
+
+## Version source
+
+The version source is `__version__` in `src/devx/__init__.py`, read by
+setuptools via `dynamic = ["version"]` in `pyproject.toml`. The release
+script updates this file, commits it, and tags the commit. This ensures the
+package version, git tag, and changelog always stay aligned.

docs/tech/ci-cd-workflow.md

@@ -1,85 +1,557 @@
 # CI/CD Workflow
 
-devx uses Gitea Actions for CI/CD automation. The workflow replicates GRM's automated pipeline but without molecule tests.
+devx uses Gitea Actions for CI/CD automation. Three workflows implement a
+complete pipeline: pull request validation, post-merge release automation, and
+tag-triggered publishing.
 
-## Workflows
+## Workflow overview
 
-### CI (`ci.yml`)
+```
+PR opened/synchronized ──► CI (ci.yml)
+    │                         ├── quality
+    │                         ├── detect-changes
+    │                         ├── release-dry-run (if user-facing)
+    │                         ├── pr-review
+    │                         └── auto-merge ──► squash-merge to master
+    │                                              │
+    ▼                                              ▼
+Push to master ──► Post-merge (post-merge.yml)
+                     ├── detect-type
+                     ├── validate-commit-msg
+                     ├── release ──► tag vX.Y.Z
+                     ├── sync-wiki        │
+                     ├── badges           │
+                     ├── vikunja          │
+                     └── configure-repo   │
+                                          │
+                                          ▼
+Tag push (v*) ──► Publish (publish.yml)
+                     └── publish ──► Gitea PyPI registry + Gitea release
+```
 
-Runs on pull requests. Jobs:
+## CI workflow (`ci.yml`)
 
-1. **quality** — lint (ruff, pyright, bandit, actionlint), unit tests with 100% coverage, test speed check, doc coverage, translation check, dependency scan
-2. **detect-changes** — classify changes as user-facing or workflow-only
-3. **release-dry-run** — dry-run the release script (only if user-facing changes)
-4. **pr-review** — automated PR review
-5. **auto-merge** — squash-merge PR when all checks pass
+Runs on pull requests (opened and synchronize) and manual dispatch.
 
-### Post-merge (`post-merge.yml`)
+### Jobs
 
-Runs on every push to master. Jobs:
+#### `quality`
 
-1. **detect-type** — check if commit is a release commit
-2. **validate-commit-msg** — validate conventional commit format
-3. **release** — calculate next version, update changelog, tag, push
-4. **sync-wiki** — sync docs to Gitea wiki
-5. **badges** — generate and push quality badges
-6. **vikunja** — mark Vikunja task as done
-7. **configure-repo** — ensure branch protection and labels
+The main quality gate. Runs on every PR:
 
-### Publish (`publish.yml`)
+1. **Lint all** — ruff check, ruff format check, pyright, bandit, actionlint
+   (via `make lint-all`)
+2. **Unit tests with 100% coverage** — `make pytest-cov`
+3. **Check unit test speed** — `python -m devx.tools.check_test_speed
+   --max-seconds 4 --max-single-seconds 0.5`
+4. **Documentation coverage check** — `python -m devx.ci.doc_coverage
+   --fail-on-missing`
+5. **Translation completeness check** — `python -m devx.ci.check_translations`
+6. **Dependency security scan** — `pip-audit --desc --skip-editable`
+   (best-effort, non-blocking)
+7. **Workflow dry-run validation** — `make workflow-dryrun` via act_runner
+   (best-effort, skipped if act_runner is not installed)
 
-Runs on tag pushes (`v*`). Builds the package, publishes to Gitea PyPI registry, and creates a Gitea release.
+#### `detect-changes`
 
-## CI Scripts
+Classifies changes between `origin/master` and the PR head as user-facing or
+workflow-only using `python -m devx.ci.classify_changes --github-output`.
+Writes `user-facing-changed=true|false` to the job output for use by
+downstream jobs.
 
-### auto_merge.py
+#### `release-dry-run`
 
-Auto-merge PR when all CI checks pass. Reads task ID from `.taskid`, validates PR title format, checks Vikunja task exists, squash-merges with `DEVX-N <conventional commit>` title.
+Depends on `quality` and `detect-changes`. Only runs if user-facing changes
+are detected. Runs `python -m devx.ci.release --dry-run` to validate that
+the release script can calculate the next version and generate the changelog
+without making changes. Non-blocking (uses `|| true`).
 
-### release.py
+#### `pr-review`
 
-Automated release using git-cliff. Calculates next semver version from conventional commits, updates `__version__` in `__init__.py`, updates `CHANGELOG.md`, runs lint and tests, commits with `release: vX.Y.Z [skip ci]`, creates annotated tag, pushes.
+Runs on every pull request. Executes `python -m devx.ci.pr_review` with the
+PR number and repository. Fetches the PR diff via the Gitea API and runs
+automated checks, posting a structured review:
 
-### publish.py
+- `COMMENT` — no issues found
+- `REQUEST_CHANGES` — issues found that must be addressed
 
-Builds package with `python -m build`, publishes to Gitea PyPI registry via twine, creates Gitea release with git-cliff-generated notes.
+Checks performed:
+1. Architecture compliance — no subprocess in CLI, no hardcoded URLs
+2. Best practices — no `print()`, no bare `except`, no `TODO`/`FIXME`,
+   no functions > 50 lines
+3. Security — no hardcoded secrets, no `shell=True`, no `eval`/`exec`
+4. i18n — no raw strings in `click.echo()` without `_()` wrapper
+5. Resource management — no `open()` without `with`, no `Popen()` without
+   cleanup
+6. Documentation — source changes must include doc updates
+7. Test coverage — source changes must include test updates
+8. Commit conventions — conventional commit format on PR commits
 
-### pr_review.py
+#### `auto-merge`
 
-Automated PR review. Checks architecture compliance, best practices, security, i18n, resource management, documentation, test coverage, and commit conventions. Posts inline comments and structured review.
+Depends on `quality`, `detect-changes`, and `pr-review`. The final job in the
+CI workflow. Runs `python -m devx.ci.auto_merge` with the branch name, PR
+title, repository, and PR number:
 
-### notify_failure.py
+1. **Read task ID** from branch name (e.g., `DEVX-12-fix-foo` → `DEVX-12`),
+   falling back to `.taskid` file for branches without a task ID prefix
+2. **Validate PR title format** — must be `{PREFIX}-N: <vikunja task title>`
+3. **Validate PR title matches Vikunja task** — fetches the Vikunja task and
+   compares the title
+4. **Extract conventional commit message** from PR commits (newest matching
+   conventional format)
+5. **Squash-merge** with title `{PREFIX}-N <conventional commit message>`
+6. If the head branch is behind master (HTTP 405), automatically pulls master,
+   rebases, force-pushes, and retries the merge
 
-Creates a Gitea issue when a CI workflow fails. Uses tea CLI for issue creation with failure labels.
+The merge commit push to master triggers the post-merge workflow.
 
-### post_merge.py
+### Smart CI: user-facing vs workflow-only changes
 
-Updates Vikunja task after a merge to master. Extracts task ID from commit message, marks task as done, posts a comment with the merge SHA.
+Not all changes require a new release. The `detect-changes` job classifies
+changes using `python -m devx.ci.classify_changes`:
 
-### classify_changes.py
+**Workflow-only paths** (infrastructure — no release needed):
+- `.gitea/**` — Gitea Actions workflows
+- `tests/**` — Test files
+- `AGENTS.md`, `README.md`, `CHANGELOG.md` — Project docs
+- `Makefile`, `cliff.toml`, `.pre-commit-config.yaml` — Config
+- `.env.example`, `.gitignore` — Config
+- `hooks/**` — Git hooks
+- `src/devx/__init__.py` — Only contains `__version__` (release artifact)
 
-Classifies git changes as user-facing or workflow-only. Used to skip releases for infrastructure-only changes. Patterns are configurable.
+**User-facing paths** (tool changes — release needed) — everything else:
+- `src/devx/**` — Python package source (except `__init__.py`)
+- `pyproject.toml` — Package metadata
+- Any new file type not in the allowlist
 
-### discover_runners.py
+Classification is configured in `pyproject.toml` under
+`[tool.devx.classify]`. The framework provides `DEFAULT_INFRASTRUCTURE` — a
+curated list of paths that are infrastructure for any Python project. Projects
+inherit these automatically and only specify what is different.
 
-Discovers available Gitea Actions runners at repo, org, and instance levels. Generates a dynamic matrix for parallel job distribution.
+Rule priority (first match wins):
+1. `user_facing_overrides` — safety override (highest priority)
+2. `infrastructure_overrides` — explicit per-file
+3. `infrastructure` — DEFAULT_INFRASTRUCTURE + project-specific patterns
+4. Default: user-facing (safe — any unknown file triggers release)
 
-### detect_release_commit.py
+## Post-merge workflow (`post-merge.yml`)
 
-Detects whether the latest git commit is a release commit. Writes `is-release=true` or `is-release=false` to GitHub output.
+Runs on every push to master. A single workflow with conditional jobs
+replaces separate workflows for release, wiki sync, badges, and Vikunja task
+updates.
 
-### push_badges.py
+### Job dependency graph
 
-Generates SVG badge files from project metrics (tests, coverage, quality, version). Pushes to `badges` branch and updates README with cache-busting commit SHA URLs.
+```
+detect-type ──┬── validate-commit-msg (skip if release commit)
+              ├── release (skip if release commit)
+              │       │
+              │       ├── sync-wiki (needs release)
+              │       ├── badges (needs release, ALWAYS runs)
+              │       └── vikunja (needs release)
+              └── configure-repo (independent, skip if release commit)
+```
 
-### distribute_molecule.py
+`sync-wiki` and `vikunja` depend on `release` succeeding so that the wiki and
+task tracker are only updated when the code is actually released. If release
+fails, they are skipped to avoid leaving the wiki or Vikunja in an
+inconsistent state.
 
-Distributes molecule (scenario, platform) pairs across N parallel runners. Discovers scenarios under `ansible/roles/*/molecule/`.
+The `badges` job uses `if: always()` with no is-release condition so it runs
+on every push to master, including release commits. This ensures badges
+(tests, coverage, version, etc.) are always current.
 
-### molecule_ci_guard.py
+When `release` creates a `release: vX.Y.Z` commit, the release commit's
+post-merge run still updates badges (the version badge picks up the new
+version). Other jobs skip. The tag push triggers `publish.yml`.
 
-Runs molecule tests sequentially while polling Gitea for other runner failures. Aborts if another runner fails the same job.
+### Jobs
 
-### validate_commit_msg.py
+#### `detect-type`
 
-Validates commit messages. On feature branches: conventional commits only (no `DEVX-N` prefix). On master: must have `DEVX-N` prefix from auto-merge.
+Checks if the latest commit is a release commit (`release: vX.Y.Z [skip ci]`)
+using `python -m devx.ci.detect_release_commit`. Writes `is-release=true` or
+`is-release=false` to the job output. All subsequent jobs use this to
+conditionally skip for release commits.
+
+#### `validate-commit-msg`
+
+Depends on `detect-type`. Skips for release commits. Validates the latest
+commit message using `python -m devx.ci.validate_commit_msg --branch master`.
+On master, commits must follow `{PREFIX}-N: <conventional commit>` format
+(added by auto-merge).
+
+#### `release`
+
+Depends on `detect-type`. Skips for release commits. The core release
+automation job. Runs `python -m devx.ci.release`:
+
+1. **Classify changes** — calls `classify_changes.py` to check for user-facing
+   changes. If only infrastructure files changed, exits without releasing.
+2. **Calculate next version** — uses git-cliff to determine the next semver
+   version from conventional commits since the last tag
+3. **Update version file** — updates `__version__` in `src/devx/__init__.py`
+4. **Update changelog** — prepends the new version section to `CHANGELOG.md`
+   using git-cliff output
+5. **Run tests** — executes `make lint-ruff` and `make pytest-cov` to verify
+   the release is healthy. If either fails, the release is aborted — no
+   commit, no tag. Use `--skip-tests` only for emergency releases.
+6. **Commit** — stages the version file and changelog, commits with
+   `release: vX.Y.Z [skip ci]` (uses `--no-verify` to bypass the commit-msg
+   hook since release commits are a special case)
+7. **Create tag** — creates an annotated tag `vX.Y.Z` with the changelog as
+   the tag message
+8. **Push** — pushes both the commit and tag to master
+
+The script is idempotent: if there are no new conventional commits since the
+last tag, it exits without doing anything. If the tag already exists (e.g.,
+from a partial previous run), it skips tag creation and only pushes.
+
+**Tag consistency**: Before releasing, the script fetches remote tags and
+verifies all existing tags point to commits whose message matches the tag
+version. This prevents duplicate release commits and ensures
+tag/version/commit alignment.
+
+**Version bumping rules** (git-cliff):
+
+| Commit type | Version bump |
+|-------------|-------------|
+| `feat:` | minor (0.X.0) |
+| `fix:` | patch (0.0.X) |
+| `feat!:` or `BREAKING CHANGE` | minor (pre-1.0) |
+| `chore:`, `ci:`, `docs:` | no bump (excluded by cliff.toml) |
+
+On failure, the `notify_failure` step creates a Gitea issue via
+`python -m devx.ci.notify_failure`.
+
+#### `sync-wiki`
+
+Depends on `detect-type` and `release`. Skips for release commits. Syncs
+documentation from `docs/` to the Gitea wiki using
+`python -m devx.ci.sync_wiki --repo <owner/repo> --strict`:
+
+1. Reads `docs/mapping.json` to map file paths to wiki page titles
+2. Lists existing wiki pages via the Gitea API
+3. For each mapped file, reads content and creates or updates the wiki page
+4. `--strict` runs a full integrity check: verifies page count, missing
+   pages, stale pages, and content match. Fails if any page is empty or
+   content doesn't match.
+
+Pages that exist in the wiki but not in the mapping are left untouched (not
+deleted).
+
+On failure, the `notify_failure` step creates a Gitea issue.
+
+#### `badges`
+
+Depends on `detect-type` and `release`. Uses `if: always()` so it runs on
+every push to master, including release commits. Generates and pushes quality
+badges using `python -m devx.ci.push_badges`:
+
+1. **Fetch latest master** — `git fetch origin master && git reset --hard
+   origin/master` (ensures the version badge reflects the current state,
+   even if the release job just pushed a new version)
+2. **Generate badges** — calls `devx.tools.generate_badges` which runs
+   pytest-cov, doc-coverage, lint checks, and version extraction, then writes
+   SVG files: `coverage.svg`, `tests.svg`, `docs.svg`, `quality.svg`,
+   `version.svg`, `python.svg`
+3. **Push to badges branch** — creates an orphan `badges` branch, copies SVG
+   files, commits, and force-pushes
+4. **Update README/docs** — switches back to master, replaces
+   `raw/branch/badges/<name>.svg` URLs with `raw/commit/<sha>/<name>.svg`
+   URLs (cache-busting — Gitea caches `raw/branch/` URLs for 6 hours),
+   commits, and pushes
+
+Supports `--retries` for retrying on git push failures (fetches latest master
+and waits 10s between attempts).
+
+On failure, the `notify_failure` step creates a Gitea issue.
+
+#### `vikunja`
+
+Depends on `detect-type` and `release`. Skips for release commits. Updates
+the Vikunja task after a merge using `python -m devx.ci.post_merge --git-sha
+<sha>`:
+
+1. Extracts the task ID from the first line of the commit message
+2. Marks the corresponding Vikunja task as done
+3. Posts a comment with the merge SHA
+
+On failure, the `notify_failure` step creates a Gitea issue.
+
+#### `configure-repo`
+
+Depends on `detect-type`. Skips for release commits. Ensures branch
+protection and labels are configured using
+`python -m devx.tools.configure_repo --repo <name> --owner <owner>`:
+
+- Sets up master branch protection (required status checks, block on rejected
+  reviews, block on outdated branch)
+- Creates standard labels
+- Status check contexts read from `DEVX_STATUS_CHECKS` or default to
+  `CI / quality (pull_request)`
+
+On failure, the `notify_failure` step creates a Gitea issue.
+
+## Publish workflow (`publish.yml`)
+
+Runs on tag pushes matching `v*`. Triggered by the `release` job in the
+post-merge workflow when it creates and pushes a new version tag.
+
+### Job: `publish`
+
+1. **Install dependencies** — build, twine, requests, python-dotenv, click,
+   and the project itself
+2. **Install CI tools** — git-cliff and tea via
+   `python -m devx.tools.install_tools`
+3. **Configure tea login** — `tea login add` using `REPO_TOKEN`
+4. **Build and publish** — `python -m devx.ci.publish <tag> <owner/repo>`:
+   - Build the package with `python -m build`
+   - Publish to the Gitea PyPI registry (default) using `twine upload
+     --repository-url <url> -u <token> -p <token>`
+   - OR publish to standard PyPI if `PYPI_TOKEN` is set
+   - OR skip publishing if `--skip-build` is passed (non-Python repos)
+   - Create a Gitea release with git-cliff-generated release notes via
+     `tea create release`
+
+Publishing destination resolution (checked in order):
+1. **Gitea PyPI registry** — if `--registry-url` is given, or
+   `DEVX_PYPI_REGISTRY_URL` env var is set, or derived from `GITEA_API_URL`
+2. **Standard PyPI** — if `PYPI_TOKEN` is set (takes precedence over Gitea
+   registry)
+3. **Skip** — if neither is configured, only the Gitea release is created
+
+On failure, the `notify_failure` step creates a Gitea issue.
+
+## CI scripts
+
+### `auto_merge.py`
+
+Auto-merge PR when all CI checks pass. Reads task ID from the branch name
+(e.g., `DEVX-12-fix-foo` → `DEVX-12`), falling back to `.taskid` file for
+branches without a task ID prefix. Validates PR title format, checks the
+Vikunja task exists and the title matches, extracts the conventional commit
+message from PR commits, and squash-merges with
+`{PREFIX}-N <conventional commit>` title.
+
+```bash
+python -m devx.ci.auto_merge <branch> <pr_title> <owner/repo> <pr_number>
+```
+
+### `release.py`
+
+Automated release using git-cliff. Calculates next semver version from
+conventional commits, updates `__version__` and `CHANGELOG.md`, runs lint and
+tests, commits with `release: vX.Y.Z [skip ci]`, creates annotated tag, and
+pushes. Idempotent — exits if no unreleased changes.
+
+```bash
+python -m devx.ci.release [--dry-run] [--skip-tests] [--verify]
+```
+
+- `--dry-run` — preview without making changes
+- `--skip-tests` — skip lint and test verification (emergency only)
+- `--verify` — check tag/version/changelog alignment and exit
+
+### `publish.py`
+
+Builds package, publishes to Gitea PyPI registry or standard PyPI, and
+creates a Gitea release with git-cliff-generated notes.
+
+```bash
+python -m devx.ci.publish <tag> <owner/repo> [--registry-url <url>] [--skip-build]
+```
+
+### `pr_review.py`
+
+Automated PR review. Fetches the PR diff via the Gitea API, runs automated
+checks (architecture, best practices, security, i18n, resource management,
+documentation, test coverage, commit conventions), and posts a structured
+review with inline comments.
+
+```bash
+python -m devx.ci.pr_review <pr_number> <owner/repo>
+```
+
+### `notify_failure.py`
+
+Creates a Gitea issue when a CI workflow fails. Uses the tea CLI for issue
+creation with failure labels. Supports `--auto-login` to configure the tea
+CLI login profile from `REPO_TOKEN`.
+
+```bash
+python -m devx.ci.notify_failure --repo <owner/repo> --run-id <id> \
+  --workflow <name> --commit <sha> [--auto-login]
+```
+
+### `post_merge.py`
+
+Updates Vikunja task after a merge to master. Extracts task ID from the
+commit message, marks the task as done, and posts a comment with the merge SHA.
+
+```bash
+python -m devx.ci.post_merge <commit_msg> [--commit-sha <sha>] [--git-sha <sha>]
+```
+
+### `classify_changes.py`
+
+Classifies git changes as user-facing or workflow-only. Uses a layered rule
+system configured in `pyproject.toml`. Safe-by-default: any unknown file
+defaults to user-facing.
+
+```bash
+python -m devx.ci.classify_changes [--base <ref>] [--head <ref>] \
+  [--quiet] [--check <category>] [--github-output]
+```
+
+### `discover_runners.py`
+
+Discovers available Gitea Actions runners at repository, organization, and
+instance levels. Falls back to `MOLECULE_RUNNERS` repo variable or
+`DEFAULT_MAX_RUNNERS` (3).
+
+```bash
+python -m devx.ci.discover_runners --owner <owner> --repo <repo> [--count] [--indices]
+```
+
+### `detect_release_commit.py`
+
+Detects whether the latest git commit is a release commit. Writes
+`is-release=true|false` to `$GITHUB_OUTPUT`.
+
+```bash
+python -m devx.ci.detect_release_commit
+```
+
+### `push_badges.py`
+
+Generates SVG badge files, pushes them to the `badges` branch, and updates
+README.md and docs/index.md with cache-busting `raw/commit/<sha>/` URLs.
+
+```bash
+python -m devx.ci.push_badges [--output-dir <dir>] [--branch <branch>] \
+  [--no-readme-update] [--retries <n>]
+```
+
+### `distribute_molecule.py`
+
+Distributes molecule (scenario, platform) pairs across N parallel runners.
+Discovers scenarios under `ansible/roles/*/molecule/`.
+
+```bash
+python -m devx.molecule.distribute_molecule --runner-index <i> --max-runners <n>
+python -m devx.molecule.distribute_molecule --list
+python -m devx.molecule.distribute_molecule --list-platforms
+```
+
+### `molecule_ci_guard.py`
+
+Runs molecule tests sequentially while polling the Gitea API for other runner
+failures. Aborts early if another runner fails the same job. Generates JUnit
+XML when `--junit-output` is provided.
+
+```bash
+python -m devx.molecule.molecule_ci_guard [--roles-root <dir>] \
+  [--junit-output <file>] pair1 pair2 ...
+```
+
+### `validate_commit_msg.py`
+
+Validates commit messages. On feature branches: conventional commits only
+(no `{PREFIX}-N` prefix). On master: must have `{PREFIX}-N` prefix from
+auto-merge, followed by a conventional commit message.
+
+```bash
+python -m devx.ci.validate_commit_msg <commit_msg_file> [--branch <branch>]
+```
+
+### `sync_wiki.py`
+
+Syncs documentation from `docs/` to the Gitea wiki via the API. Reads
+`docs/mapping.json` for file-to-page mapping. Supports `--dry-run`,
+`--verify`, and `--strict` (full integrity check).
+
+```bash
+python -m devx.ci.sync_wiki [--dry-run] [--repo <owner/repo>] [--verify] [--strict]
+```
+
+### `check_translations.py`
+
+Validates translation files against the Python source code. Checks for
+missing keys, dead keys, and missing languages.
+
+```bash
+python -m devx.ci.check_translations [--translations <file>]...
+```
+
+### `doc_coverage.py`
+
+Checks documentation coverage for CLI commands and major modules. Parses
+Click commands from `cli.py` and verifies documentation exists.
+
+```bash
+python -m devx.ci.doc_coverage [--docs-dir <dir>] [--fail-on-missing]
+```
+
+### `distribute_files.py`
+
+Distributes files matching a glob pattern across N parallel runners
+(round-robin). Writes the assigned file list to `$GITHUB_ENV`.
+
+```bash
+python -m devx.ci.distribute_files --pattern <glob> --runner-index <i> \
+  --max-runners <n> [--github-env] [--skip-if-excess]
+```
+
+### `merge_junit.py`
+
+Merges JUnit XML reports from parallel matrix runners into a single
+consolidated report. Exit code is non-zero if any merged suite reports
+failures.
+
+```bash
+python -m devx.ci.merge_junit --pattern <glob> --output <file>
+```
+
+### `integration_guard.py`
+
+Runs pytest with cross-runner failure detection. If any other
+integration-tests matrix runner reports failure, the current pytest
+subprocess is killed and this runner exits early.
+
+```bash
+python -m devx.ci.integration_guard --junit-output <file> -- <pytest args>
+```
+
+## Release process summary
+
+The complete release process from PR to published package:
+
+1. **PR merged** — `auto-merge` squash-merges the PR to master with
+   `{PREFIX}-N <conventional commit>` title
+2. **Post-merge triggers** — the merge push triggers `post-merge.yml`
+3. **detect-type** — confirms the commit is not a release commit
+4. **release** — `release.py` calculates the next version, updates files,
+   runs tests, commits `release: vX.Y.Z [skip ci]`, creates tag `vX.Y.Z`,
+   and pushes to master
+5. **Tag push triggers publish** — the tag push triggers `publish.yml`
+6. **publish** — `publish.py` builds the package, publishes to the Gitea PyPI
+   registry, and creates a Gitea release with git-cliff notes
+7. **sync-wiki** — documentation is synced to the Gitea wiki
+8. **badges** — quality badges are regenerated and pushed to the `badges`
+   branch; README and docs/index.md are updated with cache-busting URLs
+9. **vikunja** — the corresponding Vikunja task is marked as done
+10. **configure-repo** — branch protection and labels are ensured
+
+The release commit's post-merge run skips all jobs except `badges` (which
+picks up the new version number). This prevents infinite loops.
+
+## Failure handling
+
+Every job in the post-merge and publish workflows has a `notify_failure` step
+that runs `if: failure()`. This creates a Gitea issue with the workflow name,
+run ID, and commit SHA, ensuring failures that would otherwise go unnoticed
+in the Actions tab are surfaced as issues. The issue is created via the tea
+CLI with a `bug` label if available.

docs/user/cli-commands.md

@@ -1,105 +1,481 @@
 # CLI Commands
 
 devx provides a CLI with three command groups: `ci`, `tools`, and `molecule`.
+Each subcommand delegates to the corresponding Python module via
+`python -m devx.*`, so `devx ci release` is equivalent to
+`python -m devx.ci.release`.
+
+```bash
+devx --help        # show all command groups
+devx --version     # show package version
+devx ci --help     # show CI commands
+devx tools --help  # show tools commands
+devx molecule --help  # show molecule commands
+```
 
 ## CI Commands
 
 ### `devx ci auto-merge`
 
-Auto-merge a PR when all CI checks pass. Validates PR title, checks Vikunja task, squash-merges.
+Auto-merge a PR when all CI checks pass. Reads the task ID from the branch
+name (falling back to `.taskid` file), validates the PR title format against
+the Vikunja task title, extracts the conventional commit message from PR
+commits, and squash-merges with `{PREFIX}-N <conventional commit>` title.
+
+If the head branch is behind master (HTTP 405), automatically pulls master,
+rebases, force-pushes, and retries the merge.
+
+```bash
+devx ci auto-merge <branch> <pr_title> <owner/repo> <pr_number>
+# Example:
+devx ci auto-merge DEVX-12-add-feature "DEVX-12: Add feature" oblachno-oss/devx 42
+```
 
 ### `devx ci check-translations`
 
-Check translation files for gaps, dead keys, and missing languages.
+Check translation files for gaps, dead keys, and missing languages. Validates
+translation files against the Python source code that uses them. By default,
+checks `src/devx/translations.json` against `src/devx/**/*.py`.
+
+Checks performed:
+- **Missing keys** — a `_()` call in code has no entry in the translations file
+- **Dead keys** — a key in the translations file is not used in any code
+- **Missing languages** — a key exists but is missing one of the five
+  supported languages (en, bg, de, ru, zh)
+
+```bash
+devx ci check-translations
+devx ci check-translations --translations path/to/translations.json
+```
 
 ### `devx ci classify-changes`
 
-Classify git changes as user-facing or workflow-only. Used to skip releases for infrastructure-only changes.
+Classify git changes as user-facing or workflow-only. Used to skip releases
+for infrastructure-only changes. Classification rules are configured in
+`pyproject.toml` under `[tool.devx.classify]`.
+
+```bash
+devx ci classify-changes --base origin/master --head HEAD
+devx ci classify-changes --base origin/master --head HEAD --github-output
+devx ci classify-changes --quiet --check user-facing
+devx ci classify-changes --check ansible  # custom tag from pyproject.toml
+```
+
+Options:
+- `--base <ref>` — base ref (default: latest tag)
+- `--head <ref>` — head ref (default: HEAD)
+- `--quiet` — only output true/false
+- `--check <category>` — check specific category: `all` (default),
+  `user-facing`, or any tag name defined in `[tool.devx.classify.tags]`
+- `--github-output` — write results to `$GITHUB_OUTPUT` for CI workflow steps
+
+Exit code 2 indicates workflow-only changes (no release needed).
 
 ### `devx ci detect-release-commit`
 
-Detect whether the latest git commit is a release commit (`release: vX.Y.Z [skip ci]`).
+Detect whether the latest git commit is a release commit
+(`release: vX.Y.Z [skip ci]`). Writes `is-release=true` or `is-release=false`
+to `$GITHUB_OUTPUT` for use in CI workflow conditionals.
+
+```bash
+devx ci detect-release-commit
+```
 
 ### `devx ci discover-runners`
 
 Discover available Gitea Actions runners for dynamic job distribution.
+Queries the Gitea API for registered runners at repository, organization, and
+instance (admin) levels. Falls back to `MOLECULE_RUNNERS` repo variable or
+`DEFAULT_MAX_RUNNERS` (3).
+
+```bash
+devx ci discover-runners --owner oblachno-oss --repo devx
+devx ci discover-runners --owner oblachno-oss --repo devx --count
+devx ci discover-runners --owner oblachno-oss --repo devx --indices
+```
+
+Options:
+- `--count` — print the number of available runners
+- `--indices` — print a JSON array `[0, 1, ..., N-1]` for use as a dynamic
+  matrix in Gitea Actions
+
+### `devx ci distribute-files`
+
+Distribute files across parallel runners (round-robin). Discovers files
+matching a glob pattern, sorts them for deterministic ordering, then assigns
+them round-robin to `max_runners` groups. The assigned group for
+`runner_index` is written to `$GITHUB_ENV`.
+
+```bash
+devx ci distribute-files --pattern "tests/integration/test_*.py" \
+  --runner-index 1 --max-runners 3 --github-env
+```
+
+Options:
+- `--pattern <glob>` — glob pattern for files to distribute
+- `--runner-index <i>` — current runner index (0-based)
+- `--max-runners <n>` — total number of runners (default: 3)
+- `--github-env` — write file list to `$GITHUB_ENV`
+- `--skip-if-excess` — skip if fewer files than runners
 
 ### `devx ci doc-coverage`
 
-Check documentation coverage for CLI commands and major modules.
+Check documentation coverage for CLI commands and major modules. Parses
+Click commands from `cli.py` and checks if each has documentation in
+`docs/user/cli-commands.md`. Verifies core modules are documented in
+`architecture.md` and CI scripts in `ci-cd-workflow.md`.
+
+```bash
+devx ci doc-coverage
+devx ci doc-coverage --docs-dir docs/ --fail-on-missing
+```
+
+Options:
+- `--docs-dir <dir>` — path to the docs directory (default: `docs/`)
+- `--fail-on-missing` — exit with non-zero status if any documentation is
+  missing
+
+### `devx ci integration-guard`
+
+Run pytest with cross-runner failure detection and JUnit XML output. If any
+other integration-tests matrix runner reports failure, the current pytest
+subprocess is killed and this runner exits early with code 1.
+
+```bash
+devx ci integration-guard --junit-output junit-results/runner-1.xml -- test_a.py test_b.py
+devx ci integration-guard --junit-output junit-results/runner-1.xml -- -x -v --tb=short test_a.py
+```
+
+Environment variables:
+- `GITEA_URL` — base URL of the Gitea instance
+- `REPO_TOKEN` — API token with repo access
+- `RUN_ID` — workflow run ID (`GITHUB_RUN_ID`)
+- `JOB_NAME` — base job name (`GITHUB_JOB`)
+- `MATRIX_INDEX` — current matrix index (runner-index)
+- `GITEA_REPOSITORY` — repository in `owner/repo` format
+
+### `devx ci merge-junit`
+
+Merge multiple JUnit XML reports from parallel runners into a single
+consolidated report. Exit code is non-zero if any merged test suite reports
+failures, making it suitable as a CI gating step after matrix jobs.
+
+```bash
+devx ci merge-junit --pattern "junit-results/runner-*.xml" --output junit-merged.xml
+```
 
 ### `devx ci notify-failure`
 
-Create a Gitea issue when a CI workflow fails.
+Create a Gitea issue when a CI workflow fails. Uses the tea CLI for issue
+creation with a `bug` label if available.
+
+```bash
+devx ci notify-failure --repo oblachno-oss/devx --run-id 123 \
+  --workflow ci --commit abc123def456
+devx ci notify-failure --repo oblachno-oss/devx --run-id 123 \
+  --workflow post-merge/release --commit abc123def456 --auto-login
+```
+
+Options:
+- `--repo <owner/repo>` — repository (required)
+- `--run-id <id>` — CI run ID (required)
+- `--workflow <name>` — workflow name (required)
+- `--commit <sha>` — commit SHA (required)
+- `--auto-login` — configure tea CLI login from `REPO_TOKEN` before creating
+  the issue
 
 ### `devx ci post-merge`
 
-Update Vikunja task after a merge to master.
+Update Vikunja task after a merge to master. Extracts the task ID from the
+commit message, marks the task as done, and posts a comment with the merge SHA.
+
+```bash
+devx ci post-merge "DEVX-12 feat: add feature" --git-sha abc123def456
+```
 
 ### `devx ci pr-review`
 
-Run automated PR review: check architecture compliance, best practices, and quality.
+Run automated PR review. Fetches the PR diff via the Gitea API and runs a
+series of checks, posting a structured review (`COMMENT` or
+`REQUEST_CHANGES`).
+
+Checks: architecture compliance, best practices, security, i18n, resource
+management, documentation, test coverage, and commit conventions.
+
+```bash
+devx ci pr-review 42 oblachno-oss/devx
+```
 
 ### `devx ci publish`
 
-Build package, publish to Gitea PyPI registry, and create Gitea release.
+Build package, publish to Gitea PyPI registry (or standard PyPI), and create
+a Gitea release with git-cliff-generated notes.
+
+```bash
+devx ci publish v1.0.0 oblachno-oss/devx
+devx ci publish v1.0.0 oblachno-oss/devx --registry-url https://git.example.com/api/packages/owner/pypi
+devx ci publish v1.0.0 oblachno-oss/devx --skip-build  # Gitea release only
+```
+
+Options:
+- `--registry-url <url>` — Gitea PyPI registry URL. Defaults to
+  `DEVX_PYPI_REGISTRY_URL` env var or a URL derived from `GITEA_API_URL`.
+  When set, publishes to Gitea PyPI instead of standard PyPI (unless
+  `PYPI_TOKEN` is also set).
+- `--skip-build` — skip package build and PyPI publish (for non-Python repos
+  that only need a Gitea release)
 
 ### `devx ci push-badges`
 
-Generate badge SVG files and push them to the `badges` branch.
+Generate badge SVG files and push them to the `badges` branch. Also updates
+`README.md` and `docs/index.md` on master with cache-busting
+`raw/commit/<sha>/` URLs.
+
+```bash
+devx ci push-badges
+devx ci push-badges --output-dir .badges/ --branch master
+devx ci push-badges --no-readme-update  # skip README update (local testing)
+devx ci push-badges --retries 3  # retry on git push failures
+```
+
+Options:
+- `--output-dir <dir>` — temporary directory for badge files (default:
+  `.badges/`)
+- `--branch <branch>` — branch to sync before generating badges (default:
+  `master`)
+- `--no-readme-update` — skip updating README with cache-busting URLs
+- `--retries <n>` — number of attempts on git push failures (default: 1).
+  Between attempts, fetches latest master and waits 10s.
 
 ### `devx ci release`
 
-Automated release: calculate next version, update files, tag, and push.
+Automated release: calculate next version, update files, tag, and push. Uses
+git-cliff to determine the next semver version from conventional commits.
+
+```bash
+devx ci release
+devx ci release --dry-run          # preview without making changes
+devx ci release --skip-tests       # skip lint and tests (emergency only)
+devx ci release --verify           # check tag/version/changelog alignment
+```
+
+Options:
+- `--dry-run` — show what would happen without making changes
+- `--skip-tests` — skip lint and test verification (NOT recommended — only
+  for emergency releases)
+- `--verify` — verify tag/version/changelog alignment and exit (no changes
+  made)
 
 ### `devx ci sync-wiki`
 
-Sync documentation from `docs/` to the Gitea wiki.
+Sync documentation from `docs/` to the Gitea wiki. Reads `docs/mapping.json`
+for file-to-page mapping. Pages that exist in the wiki but not in the mapping
+are left untouched.
+
+```bash
+devx ci sync-wiki --repo oblachno-oss/devx
+devx ci sync-wiki --repo oblachno-oss/devx --dry-run
+devx ci sync-wiki --repo oblachno-oss/devx --verify
+devx ci sync-wiki --repo oblachno-oss/devx --strict
+```
+
+Options:
+- `--dry-run` — show what would happen without making changes
+- `--repo <owner/repo>` — repository (auto-detected if omitted)
+- `--verify` — after syncing, verify each page has non-empty content. Exit 1
+  if any page is empty or mismatched.
+- `--strict` — full integrity check: verify page count, missing pages, stale
+  pages, and content. Implies `--verify`.
 
 ### `devx ci validate-commit-msg`
 
-Validate commit messages for conventional commit format.
+Validate commit messages for conventional commit format. On feature branches:
+conventional commits only (no `{PREFIX}-N` prefix). On master: must have
+`{PREFIX}-N` prefix from auto-merge, followed by a conventional commit
+message.
+
+```bash
+devx ci validate-commit-msg commit-msg.txt
+devx ci validate-commit-msg commit-msg.txt --branch master
+```
+
+Options:
+- `--branch <branch>` — override branch detection (for CI use)
 
 ## Tools Commands
 
 ### `devx tools check-test-speed`
 
-Run unit tests and enforce a maximum execution-time budget.
+Run unit tests and enforce execution-time budgets. Two quality gates:
+
+- **Total suite time** must not exceed `--max-seconds` (default: 10s)
+- **Per-test time** — no individual test may exceed `--max-single-seconds`
+  (default: 0.5s, 0 to disable)
+
+Runs `make test-unit` with `PYTEST_ADDOPTS=--durations=0` so pytest emits
+per-test timing lines.
+
+```bash
+devx tools check-test-speed
+devx tools check-test-speed --max-seconds 10
+devx tools check-test-speed --max-seconds 4 --max-single-seconds 0.5
+```
 
 ### `devx tools configure-repo`
 
-Configure repository: branch protection + labels via Gitea API.
+Configure repository: branch protection and labels via the Gitea REST API.
+Sets up master branch protection (required status checks, block on rejected
+reviews, block on outdated branch) and creates standard labels.
+
+```bash
+devx tools configure-repo --repo devx --owner oblachno-oss
+```
+
+Status check contexts are read from `DEVX_STATUS_CHECKS` (comma-separated) or
+default to `CI / quality (pull_request)`.
 
 ### `devx tools generate-badges`
 
-Generate self-contained SVG badge files from project metrics.
+Generate self-contained SVG badge files from project metrics. Runs
+pytest-cov, doc-coverage, lint checks, and version extraction, then writes
+SVG files that can be served as static files from the Gitea raw file API.
+
+Badges generated: `coverage.svg`, `tests.svg`, `docs.svg`, `quality.svg`,
+`version.svg`, `python.svg`.
+
+```bash
+devx tools generate-badges
+devx tools generate-badges --output-dir .badges/
+```
+
+### `devx tools generate-cliff-config`
+
+Generate a `cliff.toml` configuration file with the correct task ID prefix
+preprocessor. Eliminates the need to manually duplicate and maintain
+`cliff.toml` across repos that use devx.
+
+```bash
+devx tools generate-cliff-config --prefix GRM
+devx tools generate-cliff-config --prefix GRM --output cliff.toml
+devx tools generate-cliff-config --prefix GRM --force  # overwrite existing
+```
+
+Options:
+- `--prefix <prefix>` — task ID prefix (default: `DEVX_TASK_PREFIX` env var
+  or `DEVX`)
+- `--output <file>` — output file path (default: `cliff.toml`)
+- `--force` — overwrite existing file
 
 ### `devx tools install-checkmake`
 
-Install checkmake (Makefile linter) if not already present.
+Install checkmake (Makefile linter) if not already present. Tries
+`go install` first if Go is available, otherwise downloads the latest
+pre-built Linux binary from the official GitHub releases.
+
+```bash
+devx tools install-checkmake
+```
 
 ### `devx tools install-tools`
 
-Install CI/CD development tools: actionlint, git-cliff, act_runner, tea.
+Install CI/CD development tools that are not Python packages: actionlint,
+git-cliff, act_runner, and tea. Each tool is installed to `~/.local/bin` if
+not already on PATH. Idempotent: skips tools that are already available.
+
+```bash
+devx tools install-tools                    # install all
+devx tools install-tools --tool actionlint  # install one
+devx tools install-tools --tool git-cliff --tool tea  # install specific
+devx tools install-tools --list             # list status
+```
 
 ### `devx tools setup`
 
-Project setup: install Python deps and pre-commit hooks.
+Project setup: install Python dependencies (editable mode with extras),
+Ansible Galaxy collections (if `ansible/requirements.yml` exists), pre-commit
+hooks (pre-commit, commit-msg, pre-push), and configure the tea CLI login
+profile from `.env`.
+
+```bash
+devx tools setup --bin .venv/bin
+devx tools setup --bin .venv/bin --extras "ci,lint"
+devx tools setup --bin .venv/bin --no-pre-commit --no-tea-login
+```
+
+Options:
+- `--bin <dir>` — virtualenv bin directory (required)
+- `--extras <groups>` — pip extras to install (default: `dev`)
+- `--no-pre-commit` — skip pre-commit hook installation
+- `--no-tea-login` — skip tea CLI login configuration
 
 ## Molecule Commands
 
-### `devx molecule distribute`
-
-Distribute molecule test pairs across parallel runners.
-
-### `devx molecule discover-runners`
-
-Discover available Gitea Actions runners for molecule tests.
-
-### `devx molecule guard`
-
-Run molecule tests sequentially with CI failure polling.
+Molecule commands require the `molecule` extra (`pip install devx[molecule]`).
 
 ### `devx molecule all`
 
-Run all molecule scenarios on all supported OS platforms.
+Run all molecule scenarios on all supported OS platforms. Sequential
+execution — CI uses the parallel matrix instead.
+
+```bash
+devx molecule all
+devx molecule all --bin .venv/bin
+```
+
+### `devx molecule discover-runners`
+
+Discover available Gitea Actions runners for molecule tests. Same logic as
+`devx ci discover-runners` but intended for molecule-specific workflows.
+
+```bash
+devx molecule discover-runners --owner oblachno-oss --repo devx --indices
+```
+
+### `devx molecule distribute`
+
+Distribute molecule (scenario, platform) pairs across N parallel runners.
+Discovers scenarios under `ansible/roles/*/molecule/` and crosses them with
+the supported OS platform matrix.
+
+```bash
+devx molecule distribute --runner-index 1 --max-runners 3
+devx molecule distribute --list              # list all scenarios
+devx molecule distribute --list-platforms    # list platforms
+devx molecule distribute --roles-root ansible/roles  # multi-role repos
+```
+
+Options:
+- `--runner-index <i>` — current runner index (0-based)
+- `--max-runners <n>` — total number of runners (default: 3)
+- `--list` — list all scenarios, one per line
+- `--list-platforms` — list all platforms, one per line
+- `--roles-root <dir>` — roles root directory for multi-role repos (default:
+  `ansible/roles`)
+
+### `devx molecule guard`
+
+Run molecule tests sequentially with CI failure polling. A background thread
+polls the Gitea API. If any other molecule matrix runner reports failure, the
+current molecule subprocess is killed and this runner exits early with code 1.
+
+```bash
+devx molecule guard pair1 pair2 pair3
+devx molecule guard --roles-root ansible/roles pair1 pair2
+devx molecule guard --junit-output junit-results/runner-1.xml pair1 pair2
+```
+
+Each pair is encoded as:
+- **Single-role (4-part):** `scenario|platform_name|platform_image|platform_command`
+- **Multi-role (5-part):** `role|scenario|platform_name|platform_image|platform_command`
+
+Options:
+- `--roles-root <dir>` — roles root directory for multi-role repos
+- `--junit-output <file>` — generate JUnit XML report
+
+Environment variables:
+- `GITEA_URL` — base URL of the Gitea instance
+- `REPO_TOKEN` — API token with repo access
+- `RUN_ID` — workflow run ID (`GITHUB_RUN_ID`)
+- `JOB_NAME` — base job name (`GITHUB_JOB`)
+- `MATRIX_INDEX` — current matrix index (runner-index)
+- `GITEA_REPOSITORY` — repository in `owner/repo` format

hooks/pre-commit

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# pre-commit hook: fail if unit tests take longer than 10 seconds.
-# Aligned with CI timeout (ci.yml uses --max-seconds 10).
+# pre-commit hook: fail if unit tests are too slow.
+# Checks both total suite time (10s) and per-test time (0.5s).
+# Aligned with CI (ci.yml uses same thresholds).
 set -e
 export PYTHONPATH=src
-python3 -m devx.tools.check_test_speed --max-seconds 10
+python3 -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5

pyproject.toml

@@ -30,6 +30,8 @@ version = {attr = "devx.__version__"}
 ci = [
     "pytest>=9.1.0",
     "pytest-cov>=7.1.0",
+    "build>=1.5.0",
+    "twine>=6.2.0",
 ]
 # Lint and type-checking tools (quality job)
 lint = [

src/devx/__init__.py

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""
 
-__version__ = "0.4.3"
+__version__ = "0.11.1"

src/devx/ci/_shared.py

@@ -0,0 +1,18 @@
+"""Shared utilities for CI modules."""
+
+from __future__ import annotations
+
+import subprocess  # nosec B404
+
+
+def get_latest_tag() -> str:
+    """Get the latest git tag, or empty string if none exists."""
+    result = subprocess.run(  # nosec B603 B607
+        ["git", "describe", "--tags", "--abbrev=0"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        return ""
+    return result.stdout.strip()

src/devx/ci/auto_merge.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
 """Auto-merge PR when all CI checks pass.
 
-Runs as the final job in ci.yml. Reads the task ID from ``.taskid`` file
-(falling back to branch name extraction for backwards compatibility),
-validates the PR title, and squash-merges with a conventional commit
-message prefixed by the task ID.
+Runs as the final job in ci.yml. Reads the task ID from the branch name
+(e.g., ``DEVX-31-fix-foo`` → ``DEVX-31``), validates the PR title against
+the Vikunja task, and squash-merges with a conventional commit message
+prefixed by the task ID.
 
 PR title format:    ``{PREFIX}-N: <vikunja task title>``
 Merge commit format: ``{PREFIX}-N <conventional commit message>``
@@ -42,7 +42,7 @@ from devx.config import (
 from devx.exceptions import APIError
 from devx.i18n import _
 
-TASKID_FILE = ".taskid"
+TASKID_FILE = ".taskid"  # Deprecated, kept for backward-compat warnings
 PR_TITLE_RE = re.compile(rf"^{TASK_PREFIX}-\d+:\s+.+")
 
 load_dotenv()
@@ -63,20 +63,32 @@ def run_cmd(args: list[str], check: bool = True) -> subprocess.CompletedProcess[
 
 
 def read_taskid(branch: str) -> str:
-    """Read task ID from .taskid file, falling back to branch name extraction.
+    """Read task ID from branch name.
 
-    The .taskid file is a simple text file containing just the task ID
-    (e.g., ``DEVX-60``).  If the file doesn't exist, extract from the
-    branch name as a backwards-compatibility fallback.
+    The branch name is the sole source of truth for the task ID
+    (e.g., ``DEVX-31-fix-foo`` → ``DEVX-31``).  Branches must include
+    the task ID prefix — there is no ``.taskid`` file fallback.
+
+    If a stale ``.taskid`` file exists and disagrees with the branch
+    name, a deprecation warning is printed advising its removal.
     """
-    path = Path(TASKID_FILE)
-    if path.exists():
-        task_id = path.read_text(encoding="utf-8").strip()
-        if task_id:
-            return task_id
-    # Fallback: extract from branch name
-    match = TASK_ID_RE.search(branch)
-    return match.group(0) if match else ""
+    branch_task_id = extract_task_id(branch)
+    if branch_task_id:
+        # Warn about stale .taskid file if it exists and disagrees
+        path = Path(TASKID_FILE)
+        if path.exists():
+            file_task_id = path.read_text(encoding="utf-8").strip()
+            if file_task_id and file_task_id != branch_task_id:
+                click.echo(
+                    _(
+                        "WARNING: .taskid file ({file_id}) is deprecated and disagrees with branch name ({branch_id}). "
+                        "Delete .taskid from the repo — branch name is the sole source of truth.",
+                        file_id=file_task_id,
+                        branch_id=branch_task_id,
+                    )
+                )
+        return branch_task_id
+    return ""
 
 
 def extract_task_id(branch: str) -> str:
@@ -204,7 +216,8 @@ def main(branch: str, pr_title: str, repo: str, pr_number: str) -> None:
     if not task_id:
         raise click.ClickException(
             _(
-                "Oops! No task ID found in .taskid file or branch name '{branch}'.",
+                "Oops! No task ID found in branch name '{branch}'. "
+                "Branch names must include the task ID prefix (e.g., DEVX-31-fix-bug).",
                 branch=branch,
             )
         )

src/devx/ci/classify_changes.py

@@ -138,6 +138,7 @@ from typing import Any
 
 import click
 
+from devx.ci._shared import get_latest_tag
 from devx.i18n import _
 
 # ---------------------------------------------------------------------------
@@ -297,8 +298,6 @@ DEFAULT_INFRASTRUCTURE: list[str] = [
     "activate.sh",
     "activate.fish",
     "activate.zsh",
-    # CI task tracking file (written by CI, not by developers)
-    ".taskid",
 ]
 
 
@@ -494,19 +493,6 @@ def get_changed_files(base: str, head: str) -> list[str]:
     return output.split("\n")
 
 
-def get_latest_tag() -> str:
-    """Get the latest git tag, or empty string if none exists."""
-    result = subprocess.run(  # nosec B603 B607
-        ["git", "describe", "--tags", "--abbrev=0"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        return ""
-    return result.stdout.strip()
-
-
 # ---------------------------------------------------------------------------
 # Backward-compatible API (used by release.py and CI workflows)
 # ---------------------------------------------------------------------------

src/devx/ci/distribute_files.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Distribute a list of files across N parallel runners (round-robin).
+
+Generic file-based test distribution for CI matrix jobs. Discovers files
+matching a glob pattern, sorts them for deterministic ordering, then
+assigns them round-robin to *max_runners* groups. The assigned group for
+*runner_index* is written to ``$GITHUB_ENV`` for use by subsequent steps.
+
+Usage::
+
+    python3 -m devx.ci.distribute_files \\
+        --pattern "tests/integration/test_*.py" \\
+        --runner-index 1 \\
+        --max-runners 3 \\
+        --github-env --skip-if-excess
+"""
+
+from __future__ import annotations
+
+import glob
+import os
+
+import click
+
+from devx.i18n import _
+
+DEFAULT_MAX_RUNNERS = 3
+
+
+def discover_files(pattern: str) -> list[str]:
+    """Return sorted list of file paths matching *pattern*."""
+    return sorted(glob.glob(pattern))
+
+
+def distribute(files: list[str], max_runners: int) -> list[list[str]]:
+    """Split *files* into *max_runners* balanced groups (round-robin)."""
+    groups: list[list[str]] = [[] for _ in range(max_runners)]
+    for i, f in enumerate(files):
+        groups[i % max_runners].append(f)
+    return groups
+
+
+def files_for_runner(files: list[str], runner_index: int, max_runners: int) -> list[str]:
+    """Return the subset of files assigned to *runner_index* (0-based)."""
+    groups = distribute(files, max_runners)
+    if runner_index < 0 or runner_index >= len(groups):
+        raise click.ClickException(
+            _("Runner index {index} out of range (0..{max})", index=runner_index, max=max_runners - 1)
+        )
+    return groups[runner_index]
+
+
+def _write_github_env(key: str, value: str) -> None:
+    gh_env = os.environ.get("GITHUB_ENV")
+    if not gh_env:
+        raise click.ClickException("GITHUB_ENV environment variable is not set")
+    with open(gh_env, "a") as f:  # noqa: PTH123
+        f.write(f"{key}={value}\n")
+
+
+@click.command()
+@click.option("--pattern", required=True, help="Glob pattern for files to distribute.")
+@click.option(
+    "--runner-index",
+    type=int,
+    default=None,
+    help="One-based runner index. If omitted, prints all groups.",
+)
+@click.option(
+    "--max-runners",
+    type=int,
+    default=DEFAULT_MAX_RUNNERS,
+    show_default=True,
+    help="Total number of parallel runners.",
+)
+@click.option(
+    "--github-env",
+    is_flag=True,
+    default=False,
+    help="Write ASSIGNED_FILES and SKIP to $GITHUB_ENV.",
+)
+@click.option(
+    "--skip-if-excess",
+    is_flag=True,
+    default=False,
+    help="With --github-env: write SKIP=true when runner-index exceeds max-runners.",
+)
+def main(pattern: str, runner_index: int | None, max_runners: int, github_env: bool, skip_if_excess: bool) -> None:
+    files = discover_files(pattern)
+
+    if runner_index is None:
+        groups = distribute(files, max_runners)
+        for i, group in enumerate(groups):
+            labels = " ".join(group) if group else "(none)"
+            click.echo(f"Runner {i}: {labels}")
+        return
+
+    if skip_if_excess and github_env and runner_index > max_runners:
+        click.echo(f"Skipping — runner index {runner_index} > max runners {max_runners}")
+        _write_github_env("ASSIGNED_FILES", "")
+        _write_github_env("SKIP", "true")
+        return
+
+    if runner_index < 1:
+        raise click.ClickException(f"Runner index {runner_index} is out of range (must be >= 1)")
+
+    zero_based = runner_index - 1
+    assigned = files_for_runner(files, zero_based, max_runners)
+    encoded = "\n".join(assigned)
+
+    if github_env:
+        _write_github_env("ASSIGNED_FILES", encoded)
+        _write_github_env("SKIP", "false")
+        click.echo(f"Assigned {len(assigned)} files to runner {runner_index}")
+        return
+
+    click.echo(encoded)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

src/devx/ci/integration_guard.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Run integration tests with cross-runner failure detection.
+
+Wraps ``pytest`` with the same Gitea API polling mechanism used by
+``molecule_ci_guard``. If any other integration-tests matrix runner
+reports failure, the current pytest subprocess is killed and this runner
+exits early with code 1.
+
+JUnit XML is generated via pytest's ``--junitxml`` flag (passed through
+to the pytest invocation).
+
+Usage::
+
+    python3 -m devx.ci.integration_guard \\
+        --junit-output junit-results/runner-1.xml \\
+        -- test_file1.py test_file2.py
+
+    # With pytest options
+    python3 -m devx.ci.integration_guard \\
+        --junit-output junit-results/runner-1.xml \\
+        -- -x -v --tb=short test_file1.py
+
+Environment variables:
+    GITEA_URL           Base URL of the Gitea instance.
+    REPO_TOKEN          API token with repo access.
+    RUN_ID              Workflow run ID (GITHUB_RUN_ID).
+    JOB_NAME            Base job name (GITHUB_JOB), e.g. "integration-tests".
+    MATRIX_INDEX        Current matrix index (runner-index).
+    GITEA_REPOSITORY    Repository in "owner/repo" format.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import signal
+import subprocess  # nosec B404
+import sys
+import threading
+import time
+
+import click
+
+from devx.i18n import _
+from devx.molecule.molecule_ci_guard import (
+    poll_for_other_failures,
+)
+
+POLL_INTERVAL = 10
+
+
+@click.command(context_settings={"ignore_unknown_options": True})
+@click.argument("pytest_args", nargs=-1, type=click.UNPROCESSED, required=True)
+@click.option(
+    "--junit-output",
+    default=None,
+    help="Path for JUnit XML output (passed to pytest as --junitxml).",
+)
+def cli(pytest_args: tuple[str, ...], junit_output: str | None) -> None:
+    """Run pytest with cross-runner failure detection."""
+    gitea_url = os.environ.get("GITEA_URL", "")
+    token = os.environ.get("REPO_TOKEN", "")
+    run_id = int(os.environ.get("RUN_ID", "0"))
+    job_name = os.environ.get("JOB_NAME", "integration-tests")
+    current_index = int(os.environ.get("MATRIX_INDEX", "0"))
+    repository = os.environ.get("GITEA_REPOSITORY", "oblachno-oss/devx")
+    owner, _sep, repo = repository.partition("/")
+    if not owner or not repo:
+        owner, repo = "oblachno-oss", "devx"
+
+    if not all([gitea_url, token, run_id]):
+        click.echo(_("GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation."))
+
+    stop_event = threading.Event()
+    failed_event = threading.Event()
+
+    if gitea_url and token and run_id:
+        poller = threading.Thread(
+            target=poll_for_other_failures,
+            args=(
+                gitea_url,
+                owner,
+                repo,
+                token,
+                run_id,
+                job_name,
+                current_index,
+                stop_event,
+                failed_event,
+            ),
+            daemon=True,
+        )
+        poller.start()
+
+    cmd = [sys.executable, "-m", "pytest"]
+    if junit_output:
+        cmd.extend(["--junitxml", junit_output])
+    cmd.extend(pytest_args)
+
+    click.echo(f"Running: {' '.join(cmd)}")
+
+    process = subprocess.Popen(  # nosec B603
+        cmd,
+        preexec_fn=os.setsid,
+    )
+
+    try:
+        while process.poll() is None:
+            if failed_event.is_set():
+                with contextlib.suppress(ProcessLookupError):
+                    os.killpg(os.getpgid(process.pid), signal.SIGTERM)
+                try:
+                    process.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    with contextlib.suppress(ProcessLookupError):
+                        os.killpg(os.getpgid(process.pid), signal.SIGKILL)
+                    process.wait()
+                click.echo(_("Integration tests cancelled — another runner failed."))
+                sys.exit(1)
+            time.sleep(1)
+    except KeyboardInterrupt:
+        with contextlib.suppress(ProcessLookupError):
+            os.killpg(os.getpgid(process.pid), signal.SIGTERM)
+        process.wait()
+        sys.exit(1)
+    finally:
+        stop_event.set()
+
+    rc = process.returncode
+    if rc != 0:
+        click.echo(_("Integration tests failed with exit code {code}", code=rc))
+    else:
+        click.echo(_("Integration tests passed."))
+    sys.exit(rc)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()

src/devx/ci/merge_junit.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Merge multiple JUnit XML reports into a single report.
+
+Used by CI workflows to consolidate JUnit XML files produced by
+parallel matrix runners into a single merged report for archival
+and dashboard consumption.
+
+Usage::
+
+    python3 -m devx.ci.merge_junit \\
+        --pattern "junit-results/runner-*.xml" \\
+        --output junit-merged.xml
+
+Exit code is non-zero if any merged test suite reports failures,
+making this suitable as a CI gating step after matrix jobs.
+"""
+
+from __future__ import annotations
+
+import glob
+import sys
+import xml.etree.ElementTree as ET  # nosec B405
+
+import click
+
+from devx.i18n import _
+
+
+def merge_files(pattern: str) -> tuple[ET.Element, int, int]:
+    """Merge JUnit XML files matching *pattern* into a single ``<testsuites>`` element.
+
+    Returns ``(merged_element, total_tests, total_failures)``.
+    If no files match, returns an empty ``<testsuites>`` with zero counts.
+    """
+    files = sorted(glob.glob(pattern))
+    merged = ET.Element("testsuites")
+    total_tests = 0
+    total_failures = 0
+
+    for f in files:
+        tree = ET.parse(f)  # nosec B314
+        suite = tree.getroot()
+        # Handle both <testsuites> (wrapper) and <testsuite> (single) roots
+        if suite.tag == "testsuites":
+            for child in suite:
+                merged.append(child)
+                total_tests += int(child.get("tests", 0))
+                total_failures += int(child.get("failures", 0))
+        else:
+            merged.append(suite)
+            total_tests += int(suite.get("tests", 0))
+            total_failures += int(suite.get("failures", 0))
+
+    merged.set("tests", str(total_tests))
+    merged.set("failures", str(total_failures))
+    return merged, total_tests, total_failures
+
+
+@click.command()
+@click.option(
+    "--pattern",
+    default="junit-results/runner-*.xml",
+    show_default=True,
+    help="Glob pattern for input JUnit XML files.",
+)
+@click.option(
+    "--output",
+    default="junit-merged.xml",
+    show_default=True,
+    help="Output path for the merged JUnit XML file.",
+)
+def main(pattern: str, output: str) -> None:
+    merged, total_tests, total_failures = merge_files(pattern)
+
+    if total_tests == 0:
+        click.echo(_("No JUnit reports found matching {pattern} — skipping merge.", pattern=pattern))
+        return
+
+    ET.indent(merged)
+    tree = ET.ElementTree(merged)
+    tree.write(output, encoding="UTF-8", xml_declaration=True)
+    click.echo(
+        _(
+            "Merged {count} reports: {tests} tests, {failures} failures → {output}",
+            count=len(glob.glob(pattern)),
+            tests=total_tests,
+            failures=total_failures,
+            output=output,
+        )
+    )
+
+    if total_failures > 0:
+        sys.exit(1)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

src/devx/ci/notify_failure.py

@@ -10,13 +10,20 @@ Usage:
     --repo <owner/repo> \
     --run-id <run_id> \
     --workflow <workflow_name> \
-    --commit <commit_sha>
+    --commit <commit_sha> \
+    --auto-login
+
+With ``--auto-login``, the script configures the tea CLI login profile
+from ``REPO_TOKEN`` and ``DEVX_GITEA_API_URL`` before creating the issue,
+eliminating the need for a separate ``tea login add`` step in the workflow.
 """
 
 from __future__ import annotations
 
 import logging
 import os
+import shutil
+import subprocess  # nosec B404
 
 import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
@@ -30,6 +37,49 @@ load_dotenv()
 logger = logging.getLogger("devx")
 
 
+def _configure_tea_login(login_name: str = "devx") -> None:
+    """Configure tea CLI login from REPO_TOKEN and DEVX_GITEA_API_URL.
+
+    Idempotent: if a login with the same name already exists, it is not re-added.
+    Skips silently if tea is not installed or REPO_TOKEN is not set.
+    """
+    tea_bin = shutil.which("tea")
+    if tea_bin is None:
+        click.echo("notify_failure: tea not installed — skipping login configuration.")
+        return
+
+    token = os.environ.get("REPO_TOKEN", "")
+    if not token:
+        click.echo("notify_failure: REPO_TOKEN not set — skipping login configuration.")
+        return
+
+    gitea_url = GITEA_API_URL.replace("/api/v1", "")
+
+    result = subprocess.run(  # nosec B603
+        [tea_bin, "login", "list", "--output", "simple"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode == 0 and login_name in result.stdout:
+        click.echo(f"notify_failure: tea login '{login_name}' already configured.")
+        return
+
+    click.echo(f"notify_failure: configuring tea login '{login_name}' for {gitea_url}...")
+    subprocess.run(  # nosec B603
+        [tea_bin, "login", "add", "--name", login_name, "--url", gitea_url, "--token", token],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    subprocess.run(  # nosec B603
+        [tea_bin, "login", "default", login_name],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
 def _create_issue_via_tea(repo: str, title: str, body: str) -> int:
     """Create issue via tea CLI. Returns issue index.
 
@@ -62,11 +112,20 @@ def _create_issue_via_tea(repo: str, title: str, body: str) -> int:
 @click.option("--run-id", required=True, help="CI run ID.")
 @click.option("--workflow", required=True, help="Workflow name.")
 @click.option("--commit", required=True, help="Commit SHA.")
-def main(repo: str, run_id: str, workflow: str, commit: str) -> None:
+@click.option(
+    "--auto-login",
+    is_flag=True,
+    default=False,
+    help="Configure tea CLI login from REPO_TOKEN before creating the issue.",
+)
+def main(repo: str, run_id: str, workflow: str, commit: str, auto_login: bool) -> None:
     token = os.environ.get("REPO_TOKEN", "")
     if not token:
         raise click.ClickException(_("ERROR: REPO_TOKEN is not set."))
 
+    if auto_login:
+        _configure_tea_login()
+
     title = f"[CI] {workflow} workflow failed (run #{run_id})"
     body = (
         f"The **{workflow}** workflow failed.\n\n"

src/devx/ci/publish.py

@@ -23,6 +23,7 @@ import os
 import shutil
 import subprocess  # nosec B404
 import sys
+from pathlib import Path
 
 import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
@@ -60,6 +61,12 @@ def generate_release_notes(tag: str) -> str:
 
 def build_package() -> None:
     """Build the Python package using python -m build."""
+    # Clean dist/ to avoid uploading stale packages from previous builds
+    # (Gitea PyPI returns 409 Conflict for already-published versions).
+    dist_dir = Path("dist")
+    if dist_dir.exists():
+        shutil.rmtree(dist_dir)
+
     result = subprocess.run(  # nosec B603
         [sys.executable, "-m", "build"],
         capture_output=True,
@@ -164,7 +171,14 @@ def _default_gitea_registry_url() -> str:
     "or a URL derived from GITEA_API_URL. When set, publishes to Gitea PyPI "
     "instead of standard PyPI (unless PYPI_TOKEN is also set).",
 )
-def main(tag: str, repo: str, registry_url: str | None) -> None:
+@click.option(
+    "--skip-build",
+    is_flag=True,
+    default=False,
+    help="Skip package build and PyPI publish (for non-Python repos that only "
+    "need a Gitea release with git-cliff notes).",
+)
+def main(tag: str, repo: str, registry_url: str | None, skip_build: bool) -> None:
     gitea_token = os.environ.get("REPO_TOKEN", "")
     if not gitea_token:
         raise click.ClickException(_("ERROR: REPO_TOKEN is not set."))
@@ -177,23 +191,37 @@ def main(tag: str, repo: str, registry_url: str | None) -> None:
     if not registry_url:
         registry_url = _default_gitea_registry_url()
 
-    build_package()
+    if not skip_build:
+        build_package()
 
-    if pypi_token:
-        # Standard PyPI flow takes precedence when PYPI_TOKEN is set
-        publish_to_pypi(pypi_token)
-    elif registry_url:
-        # Gitea PyPI registry flow
-        publish_to_gitea_registry(registry_url, gitea_token)
-    else:
-        click.echo(
-            _(
-                "PYPI_TOKEN not set and no registry URL configured — "
-                "skipping PyPI publish. No worries, we'll just create the Gitea release."
+        if pypi_token:
+            # Standard PyPI flow takes precedence when PYPI_TOKEN is set
+            publish_to_pypi(pypi_token)
+        elif registry_url:
+            # Gitea PyPI registry flow
+            publish_to_gitea_registry(registry_url, gitea_token)
+        else:
+            click.echo(
+                _(
+                    "PYPI_TOKEN not set and no registry URL configured — "
+                    "skipping PyPI publish. No worries, we'll just create the Gitea release."
+                )
             )
-        )
+    else:
+        click.echo(_("--skip-build: skipping package build and PyPI publish."))
 
     tea = TeaCLI(repo=repo)
+
+    # Check if release already exists (idempotent — avoids failure when
+    # called multiple times, e.g. by both post-merge and publish workflows)
+    try:
+        releases = tea.list_releases(repo)
+        if any(r.get("tag_name") == tag for r in releases):
+            click.echo(_("Gitea release {tag} already exists — skipping creation.", tag=tag))
+            return
+    except TeaCLIError:
+        pass  # If listing fails, proceed to create
+
     release_body = generate_release_notes(tag)
 
     try:

src/devx/ci/push_badges.py

@@ -17,15 +17,27 @@ Usage::
 
 from __future__ import annotations
 
+import contextlib
+import os
 import re
 import subprocess  # nosec B404
 import sys
+import time
 from pathlib import Path
 from typing import Any
 
 import click
 
-REPO_ROOT = Path(__file__).resolve().parent.parent.parent.parent
+
+def _repo_root() -> Path:
+    """Resolve repo root from GITHUB_WORKSPACE or cwd."""
+    workspace = os.environ.get("GITHUB_WORKSPACE")
+    if workspace:
+        path = Path(workspace)
+        if path.is_dir():
+            return path
+    return Path.cwd()
+
 
 # Badge filenames that get pushed to the badges branch
 BADGE_FILES = ["coverage.svg", "tests.svg", "docs.svg", "quality.svg", "version.svg", "python.svg"]
@@ -114,7 +126,7 @@ def update_readme_with_badge_sha(badges_sha: str, repo_root: Path | None = None)
     Switches back to master, replaces ``raw/branch/badges/`` URLs with
     ``raw/commit/<sha>/`` URLs, commits and pushes.
     """
-    root = repo_root or REPO_ROOT
+    root = repo_root or _repo_root()
 
     # Switch back to master
     _run(["git", "checkout", "master"])  # nosec B607
@@ -160,13 +172,34 @@ def update_readme_with_badge_sha(badges_sha: str, repo_root: Path | None = None)
     default=False,
     help="Skip updating README with cache-busting URLs (for local testing).",
 )
-def main(output_dir: str, branch: str, no_readme_update: bool) -> None:
+@click.option(
+    "--retries",
+    default=1,
+    type=int,
+    help="Number of attempts on git push failures (default: 1, no retry). "
+    "Between attempts, fetches latest master and waits 10s.",
+)
+def main(output_dir: str, branch: str, no_readme_update: bool, retries: int) -> None:
     """Generate badges and push them to the badges branch."""
-    fetch_latest_master(branch)
-    generate_badges(output_dir)
-    badges_sha = push_to_badges_branch(output_dir)
-    if not no_readme_update:
-        update_readme_with_badge_sha(badges_sha)
+    last_error: Exception | None = None
+    for attempt in range(1, retries + 1):
+        try:
+            fetch_latest_master(branch)
+            generate_badges(output_dir)
+            badges_sha = push_to_badges_branch(output_dir)
+            if not no_readme_update:
+                update_readme_with_badge_sha(badges_sha)
+            return
+        except (subprocess.CalledProcessError, RuntimeError) as exc:
+            last_error = exc
+            if attempt < retries:
+                click.echo(f"Badge push attempt {attempt}/{retries} failed — retrying: {exc}")
+                time.sleep(10)
+                with contextlib.suppress(subprocess.CalledProcessError):
+                    fetch_latest_master(branch)
+            else:
+                click.echo(f"Badge push failed after {retries} attempts: {exc}")
+    raise click.ClickException(f"Badge push failed after {retries} attempts: {last_error}")
 
 
 if __name__ == "__main__":  # pragma: no cover

src/devx/ci/release.py

@@ -23,8 +23,14 @@ This script is idempotent: if there are no new conventional commits since the
 last tag, it exits with a message and does nothing.  If the tag already exists
 (e.g., from a partial previous run), it skips tag creation and only pushes.
 
+**Tag consistency**: Before releasing, the script fetches remote tags and
+verifies all existing tags point to commits whose message matches the tag
+version.  This prevents duplicate release commits (a common issue when CI
+checkouts don't fetch tags) and ensures tag/version/commit alignment.
+
 Usage:
   REPO_TOKEN=<token> python3 -m devx.ci.release [--dry-run] [--skip-tests]
+  python3 -m devx.ci.release --verify   # Check tag/version/release alignment
 """
 
 from __future__ import annotations
@@ -32,10 +38,12 @@ from __future__ import annotations
 import os
 import re
 import subprocess  # nosec B404
+import sys
 
 import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
 
+from devx.ci._shared import get_latest_tag
 from devx.ci.classify_changes import has_user_facing_changes  # cross-CI import, needs PYTHONPATH=.
 from devx.i18n import _
 
@@ -65,20 +73,91 @@ def run_cmd(args: list[str], check: bool = True, capture: bool = True) -> subpro
     return result
 
 
-def get_latest_tag() -> str:
-    """Get the latest git tag, or empty string if none exists."""
-    result = run_cmd(["git", "describe", "--tags", "--abbrev=0"], check=False)
-    if result.returncode != 0:
-        return ""
-    return result.stdout.strip()
-
-
 def tag_exists(tag: str) -> bool:
     """Check if a git tag already exists."""
     result = run_cmd(["git", "tag", "-l", tag], check=False)
     return bool(result.stdout.strip())
 
 
+def get_tag_commit(tag: str) -> str:
+    """Get the commit hash a tag points to."""
+    result = run_cmd(["git", "rev-list", "-n1", tag], check=False)
+    return result.stdout.strip()
+
+
+def get_head_commit() -> str:
+    """Get the current HEAD commit hash."""
+    result = run_cmd(["git", "rev-parse", "HEAD"], check=False)
+    return result.stdout.strip()
+
+
+def fetch_tags() -> None:
+    """Fetch tags from remote to ensure local tag state is current.
+
+    This is critical in CI environments where a fresh checkout may not
+    include tags from previous runs.  Without this, the script may
+    create duplicate release commits because ``tag_exists`` returns False
+    for a tag that exists on the remote but wasn't fetched.
+    """
+    result = run_cmd(["git", "fetch", "--tags", "origin"], check=False)
+    if result.returncode != 0:
+        # Don't fail hard — maybe there's no remote (local-only repo)
+        click.echo(_("Warning: could not fetch tags from origin."))
+
+
+def get_all_tags() -> list[str]:
+    """Get all git tags sorted by version (newest first)."""
+    result = run_cmd(["git", "tag", "-l", "--sort=-v:refname"], check=False)
+    if result.returncode != 0:
+        return []
+    return [t.strip() for t in result.stdout.strip().split("\n") if t.strip()]
+
+
+def get_commit_version(commit: str) -> str | None:
+    """Extract version from a release commit message.
+
+    Returns the version string (e.g., '0.4.4') or None if the commit
+    is not a release commit.
+    """
+    result = run_cmd(["git", "log", "-1", "--pretty=%s", commit], check=False)
+    match = re.match(r"^release: v(\d+\.\d+\.\d+)", result.stdout.strip())
+    return match.group(1) if match else None
+
+
+def verify_tag_consistency() -> list[str]:
+    """Verify all tags point to commits with matching version in message.
+
+    Returns a list of error messages for inconsistent tags.
+    An empty list means all tags are consistent.
+
+    The first release (v0.1.0 or earliest tag) is exempt — initial releases
+    often don't have a "release:" commit message (e.g., the initial commit
+    serves as the first release).
+    """
+    errors: list[str] = []
+    tags = get_all_tags()
+    # Filter to version tags (vX.Y.Z) and sort oldest first
+    version_tags = [t for t in tags if re.match(r"^v\d+\.\d+\.\d+$", t)]
+    sorted_tags = sorted(version_tags, key=lambda t: [int(x) for x in t.lstrip("v").split(".")])
+    first_tag = sorted_tags[0] if sorted_tags else None
+    for tag in tags:
+        # Skip non-version tags (e.g., branch names like "master")
+        if not re.match(r"^v\d+\.\d+\.\d+$", tag):
+            continue
+        tag_version = tag.lstrip("v")
+        commit_version = get_commit_version(tag)
+        if commit_version is None:
+            # First tag is allowed to point to a non-release commit (initial release)
+            if tag == first_tag:
+                continue
+            errors.append(
+                f"  {tag} → points to non-release commit (expected 'release: v{tag_version}', got non-release commit)"
+            )
+        elif commit_version != tag_version:
+            errors.append(f"  {tag} → commit says 'release: v{commit_version}' (expected 'release: v{tag_version}')")
+    return errors
+
+
 def get_bumped_version() -> str:
     """Use git-cliff to calculate the next version from conventional commits."""
     result = run_cmd(["git-cliff", "--bumped-version", "--config", CLIFF_CONFIG])
@@ -123,9 +202,12 @@ def has_unreleased_changes(bumped_version: str | None = None) -> bool:
     latest = get_latest_tag()
     if not latest:
         return True
-    # Check for any commits since the last tag
+    # Check for any commits since the last tag, excluding release commits
+    # (release commits themselves are not "unreleased changes" — they ARE
+    # the release).  This prevents duplicate release commits when the
+    # script runs multiple times.
     result = run_cmd(
-        ["git", "log", f"{latest}..HEAD", "--oneline"],
+        ["git", "log", f"{latest}..HEAD", "--oneline", "--no-merges", "--invert-grep", "--grep=^release: v"],
         check=False,
     )
     if result.returncode != 0:
@@ -239,23 +321,212 @@ def create_and_push_tag(new_version: str, changelog: str, dry_run: bool) -> bool
     """Create an annotated tag with the changelog as message and push it.
 
     Returns True if the tag was created/pushed, False if it already existed.
+    Raises an error if the tag exists but points to a different commit than HEAD.
     """
     tag = f"v{new_version}"
     if tag_exists(tag):
-        click.echo(_("Tag {tag} already exists, skipping creation.", tag=tag))
+        # Verify the tag points to HEAD — if it points elsewhere, that's
+        # a consistency error, not a skip condition.
+        tag_commit = get_tag_commit(tag)
+        head_commit = get_head_commit()
+        if tag_commit != head_commit:
+            raise click.ClickException(
+                _(
+                    "Tag {tag} already exists but points to {tag_commit} "
+                    "(expected HEAD {head_commit}). "
+                    "This indicates a tag/commit misalignment. "
+                    "Run 'python3 -m devx.ci.release --verify' for details.",
+                    tag=tag,
+                    tag_commit=tag_commit[:7],
+                    head_commit=head_commit[:7],
+                )
+            )
+        click.echo(_("Tag {tag} already exists and points to HEAD. Skipping creation.", tag=tag))
         if not dry_run:
             # Ensure the existing tag is pushed
-            run_cmd(["git", "push", "origin", tag], check=False)
+            run_cmd(["git", "push", "origin", f"refs/tags/{tag}"], check=False)
         return False
     tag_msg = f"Release v{new_version}\n\n{changelog}"
     if dry_run:
         click.echo(_("[dry-run] Would create tag: {tag}", tag=tag))
         return True
     run_cmd(["git", "tag", "-a", tag, "-m", tag_msg])
-    run_cmd(["git", "push", "origin", tag])
+    run_cmd(["git", "push", "origin", f"refs/tags/{tag}"])
     return True
 
 
+# ---------------------------------------------------------------------------
+# Verification mode
+# ---------------------------------------------------------------------------
+
+
+def get_init_version() -> str | None:
+    """Read __version__ from the version file."""
+    try:
+        with open(INIT_FILE) as f:
+            content = f.read()
+        match = re.search(r'^__version__\s*=\s*"([^"]*)"', content, flags=re.MULTILINE)
+        return match.group(1) if match else None
+    except FileNotFoundError:
+        return None
+
+
+def get_changelog_versions() -> list[str]:
+    """Extract version numbers from CHANGELOG.md headers, in order."""
+    try:
+        with open(CHANGELOG_FILE) as f:
+            content = f.read()
+        return re.findall(r"^## \[(\d+\.\d+\.\d+)\]", content, flags=re.MULTILINE)
+    except FileNotFoundError:
+        return []
+
+
+def verify_alignment() -> int:
+    """Verify tag/version/changelog alignment. Returns exit code (0=ok, 1=issues)."""
+    click.echo(_("=== Release Alignment Verification ===\n"))
+
+    has_issues = False
+
+    # 1. Check __version__ matches latest tag
+    init_version = get_init_version()
+    latest_tag = get_latest_tag()
+    latest_tag_version = latest_tag.lstrip("v") if latest_tag else None
+
+    click.echo(_("Version file: {file}", file=INIT_FILE))
+    if init_version:
+        click.echo(f'  __version__ = "{init_version}"')
+    else:
+        click.echo("  __version__ = NOT FOUND")
+        has_issues = True
+
+    click.echo(_("\nLatest tag: {tag}", tag=latest_tag or "(none)"))
+    if latest_tag_version and init_version:
+        if latest_tag_version == init_version:
+            click.echo(f"  ✓ Tag version matches __version__ ({init_version})")
+        else:
+            click.echo(f"  ✗ MISMATCH: tag={latest_tag_version}, __version__={init_version}")
+            has_issues = True
+
+    # 2. Check all tags point to commits with matching version
+    click.echo(_("\nTag → Commit alignment:"))
+    tag_errors = verify_tag_consistency()
+    all_tags = get_all_tags()
+    if not all_tags:
+        click.echo("  (no tags)")
+    elif not tag_errors:
+        click.echo(f"  ✓ All {len(all_tags)} tags point to matching release commits")
+    else:
+        has_issues = True
+        for err in tag_errors:
+            click.echo(f"  ✗ {err}")
+
+    # 3. Check CHANGELOG versions are in descending order
+    click.echo(_("\nCHANGELOG version ordering:"))
+    changelog_versions = get_changelog_versions()
+    if not changelog_versions:
+        click.echo("  (no versions in CHANGELOG)")
+    else:
+        # Check for duplicates
+        seen: set[str] = set()
+        duplicates: list[str] = []
+        for v in changelog_versions:
+            if v in seen:
+                duplicates.append(v)
+            seen.add(v)
+
+        # Check ordering (should be descending)
+        is_ordered = all(changelog_versions[i] >= changelog_versions[i + 1] for i in range(len(changelog_versions) - 1))
+
+        if duplicates:
+            has_issues = True
+            click.echo(f"  ✗ Duplicate entries: {', '.join(duplicates)}")
+        elif not is_ordered:
+            has_issues = True
+            click.echo(f"  ✗ Versions not in descending order: {changelog_versions}")
+        else:
+            click.echo(f"  ✓ {len(changelog_versions)} versions, all in descending order")
+
+        # Check latest CHANGELOG version matches latest tag.
+        # The CHANGELOG may have one unreleased section ahead of the latest tag
+        # (e.g., CHANGELOG has 0.6.4 but latest tag is v0.6.3 — 0.6.4 is unreleased).
+        if changelog_versions and latest_tag_version:
+            if changelog_versions[0] == latest_tag_version:
+                click.echo(f"  ✓ Latest CHANGELOG version matches latest tag ({latest_tag_version})")
+            elif latest_tag_version in changelog_versions:
+                tag_idx = changelog_versions.index(latest_tag_version)
+                # Latest tag should be at index 0 or 1 (0 = released, 1 = unreleased ahead)
+                if tag_idx == 1:
+                    click.echo(
+                        f"  ✓ Latest CHANGELOG version ({changelog_versions[0]}) is unreleased, "
+                        f"latest tag is {latest_tag_version}"
+                    )
+                else:
+                    click.echo(
+                        f"  ✗ MISMATCH: CHANGELOG latest={changelog_versions[0]}, "
+                        f"tag={latest_tag_version} (tag is at position {tag_idx})"
+                    )
+                    has_issues = True
+            else:
+                click.echo(f"  ✗ MISMATCH: CHANGELOG latest={changelog_versions[0]}, tag={latest_tag_version}")
+                has_issues = True
+
+    # 4. Check for untagged release commits.
+    # Distinguish between:
+    # - Truly untagged: no tag exists for that version (needs a tag)
+    # - Duplicates: a tag for that version exists but on a different commit
+    #   (historical artifact from buggy release script — informational, not an error)
+    click.echo(_("\nUntagged release commits:"))
+    result = run_cmd(
+        ["git", "log", "--all", "--format=%h %s", "--grep=^release: v"],
+        check=False,
+    )
+    if result.returncode == 0 and result.stdout.strip():
+        all_release_commits = result.stdout.strip().split("\n")
+        all_tags_set = {t.lstrip("v") for t in get_all_tags() if re.match(r"^v\d+\.\d+\.\d+$", t)}
+        truly_untagged: list[str] = []
+        duplicates: list[str] = []
+        for line in all_release_commits:
+            short_hash = line.split()[0]
+            tags_at = run_cmd(["git", "tag", "--points-at", short_hash], check=False)
+            if not tags_at.stdout.strip():
+                # Check if a tag for this version exists elsewhere
+                match = re.search(r"release: v(\d+\.\d+\.\d+)", line)
+                if match and match.group(1) in all_tags_set:
+                    duplicates.append(line)
+                else:
+                    truly_untagged.append(line)
+        if truly_untagged:
+            has_issues = True
+            click.echo(f"  ✗ {len(truly_untagged)} untagged release commits (no tag for version):")
+            for c in truly_untagged[:10]:
+                click.echo(f"    {c}")
+            if len(truly_untagged) > 10:
+                click.echo(f"    ... and {len(truly_untagged) - 10} more")
+        else:
+            click.echo("  ✓ All release commits have tags")
+        if duplicates:
+            click.echo(f"  ℹ {len(duplicates)} duplicate release commits (tag exists on different commit):")
+            for c in duplicates[:5]:
+                click.echo(f"    {c}")
+            if len(duplicates) > 5:
+                click.echo(f"    ... and {len(duplicates) - 5} more")
+    else:
+        click.echo("  (no release commits found)")
+
+    # Summary
+    click.echo(_("\n=== Summary ==="))
+    if has_issues:
+        click.echo("✗ Issues found — see above for details.")
+        return 1
+    click.echo("✓ All checks passed — tags, versions, and changelog are aligned.")
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# Main command
+# ---------------------------------------------------------------------------
+
+
 @click.command()
 @click.option("--dry-run", is_flag=True, default=False, help="Show what would happen without making changes.")
 @click.option(
@@ -264,9 +535,24 @@ def create_and_push_tag(new_version: str, changelog: str, dry_run: bool) -> bool
     default=False,
     help="Skip lint and test verification (NOT recommended — only for emergency releases).",
 )
-def main(dry_run: bool, skip_tests: bool) -> None:
+@click.option(
+    "--verify",
+    is_flag=True,
+    default=False,
+    help="Verify tag/version/changelog alignment and exit (no changes made).",
+)
+def main(dry_run: bool, skip_tests: bool, verify: bool) -> None:
+    """Automated release: calculate next version, update files, tag, and push.
+
+    Use --verify to check tag/version/changelog alignment without making changes.
+    """
+    if verify:
+        sys.exit(verify_alignment())
+
     # Ensure we're on master (skip this check in dry-run mode for PR validation)
     branch = run_cmd(["git", "rev-parse", "--abbrev-ref", "HEAD"]).stdout.strip()
+    # Some git versions return "heads/master" instead of "master"
+    branch = branch.removeprefix("heads/")
     if branch != "master" and not dry_run:
         raise click.ClickException(_("Release must be run on master, currently on '{branch}'.", branch=branch))
     if branch != "master" and dry_run:
@@ -277,19 +563,56 @@ def main(dry_run: bool, skip_tests: bool) -> None:
             )
         )
 
+    # Fetch tags from remote to ensure local tag state is current.
+    # This is critical in CI where a fresh checkout may not include tags
+    # from previous runs.  Without this, tag_exists() returns False for
+    # tags that exist on the remote, leading to duplicate release commits.
+    if not dry_run:
+        fetch_tags()
+
+    # Pre-flight: verify existing tags are consistent.  If any tag points
+    # to a commit with a mismatched version, abort before creating more
+    # inconsistencies.
+    tag_errors = verify_tag_consistency()
+    if tag_errors:
+        click.echo(_("ERROR: Tag consistency check failed. Existing tags are misaligned:"))
+        for err in tag_errors:
+            click.echo(err)
+        click.echo(
+            _(
+                "\nFix the misaligned tags before creating new releases. "
+                "Run 'python3 -m devx.ci.release --verify' for a full report."
+            )
+        )
+        raise click.ClickException(_("Tag consistency check failed."))
+
     # Release lock: if HEAD is already a release commit, check if the tag
-    # exists. If the tag is missing (e.g., tag push failed in a previous run),
-    # create and push it instead of skipping — this recovers from the
-    # common failure mode where the commit was pushed but the tag was not.
+    # exists AND points to HEAD. If the tag is missing (e.g., tag push
+    # failed in a previous run), create and push it. If the tag exists
+    # but points elsewhere, that's an error.
     head_msg = run_cmd(["git", "log", "-1", "--pretty=%s"]).stdout.strip()
     release_match = re.match(r"^release: v(\d+\.\d+\.\d+)", head_msg)
     if release_match:
         release_version = release_match.group(1)
         release_tag = f"v{release_version}"
         if tag_exists(release_tag):
+            tag_commit = get_tag_commit(release_tag)
+            head_commit = get_head_commit()
+            if tag_commit != head_commit:
+                raise click.ClickException(
+                    _(
+                        "HEAD is a release commit for v{version} but tag {tag} "
+                        "points to a different commit ({tag_commit} vs HEAD {head_commit}). "
+                        "This indicates a tag/commit misalignment.",
+                        version=release_version,
+                        tag=release_tag,
+                        tag_commit=tag_commit[:7],
+                        head_commit=head_commit[:7],
+                    )
+                )
             click.echo(
                 _(
-                    "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
+                    "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
                     msg=head_msg,
                     tag=release_tag,
                 )
@@ -377,7 +700,8 @@ def main(dry_run: bool, skip_tests: bool) -> None:
         # Pull --rebase before push to handle the case where master
         # advanced between checkout and commit (e.g., another merge).
         run_cmd(["git", "pull", "--rebase", "origin", "master"], check=False)
-        run_cmd(["git", "push", "origin", "master"])
+        # Use refs/heads/master to avoid ambiguity with a 'master' tag
+        run_cmd(["git", "push", "origin", "refs/heads/master:refs/heads/master"])
         click.echo(_("Pushed release commit to master."))
     else:
         click.echo(_("Skipping commit push — no staged changes."))

src/devx/ci/sync_wiki.py

@@ -34,7 +34,13 @@ from devx.i18n import _
 
 load_dotenv()
 
-DOCS_DIR = Path(__file__).resolve().parent.parent.parent.parent / "docs"
+# DOCS_DIR is the repo's docs/ directory. When devx is installed as a
+# package (e.g., in .venv/lib/python3.12/site-packages/devx/), the
+# __file__-relative path would point inside the venv, not the repo.
+# Use DEVX_DOCS_DIR env var if set, otherwise fall back to ./docs
+# (relative to the current working directory, which is the repo root
+# in CI and local development).
+DOCS_DIR = Path(os.environ.get("DEVX_DOCS_DIR", "docs"))
 MAPPING_FILE = DOCS_DIR / "mapping.json"
 
 

src/devx/ci/validate_commit_msg.py

@@ -2,9 +2,14 @@
 """Validate commit messages for devx.
 
 Rules:
-- On feature branches: conventional commits ONLY, must NOT include DEVX-N prefix.
+- On feature branches: conventional commits ONLY, must NOT include <PREFIX>-N prefix.
 - On master branch: must follow '<task-id>: <conventional commit>' pattern,
   e.g. 'DEVX-24: fix: resolve timeout'.
+
+The task ID prefix is configurable via the ``DEVX_TASK_PREFIX`` environment
+variable (default: ``DEVX``). Projects consuming devx (e.g., GRM) set
+their own prefix (e.g., ``GRM``) so the validator enforces the correct
+task ID format for each project.
 """
 
 import re
@@ -12,10 +17,10 @@ import subprocess  # nosec B404
 
 import click
 
-from devx.config import CONVENTIONAL_RE
+from devx.config import CONVENTIONAL_RE, TASK_PREFIX
 from devx.i18n import _
 
-MASTER_TASK_ID_RE = re.compile(r"^DEVX-\d+:")
+MASTER_TASK_ID_RE = re.compile(rf"^{TASK_PREFIX}-\d+:")
 
 
 def first_line(text: str) -> str:
@@ -51,8 +56,9 @@ def main(commit_msg_file: str, branch: str | None) -> None:
             raise click.ClickException(
                 _(
                     "Oops! Master branch commits must start with a task ID.\n"
-                    "  Expected: DEVX-N: <conventional commit message>\n"
+                    "  Expected: {prefix}-N: <conventional commit message>\n"
                     "  Got:      {subject}",
+                    prefix=TASK_PREFIX,
                     subject=subject,
                 )
             )
@@ -61,8 +67,9 @@ def main(commit_msg_file: str, branch: str | None) -> None:
             raise click.ClickException(
                 _(
                     "Oops! Master branch commit must follow conventional format after task ID.\n"
-                    "  Expected: DEVX-N: <type>: <description>\n"
+                    "  Expected: {prefix}-N: <type>: <description>\n"
                     "  Got:      {subject}",
+                    prefix=TASK_PREFIX,
                     subject=subject,
                 )
             )
@@ -71,8 +78,9 @@ def main(commit_msg_file: str, branch: str | None) -> None:
     if MASTER_TASK_ID_RE.match(subject):
         raise click.ClickException(
             _(
-                "Oops! Do not include task ID (DEVX-N) in feature branch commits.\n"
-                "  The task ID will be added automatically on merge via CI."
+                "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n"
+                "  The task ID will be added automatically on merge via CI.",
+                prefix=TASK_PREFIX,
             )
         )
 

src/devx/cli.py

@@ -151,6 +151,27 @@ def ci_validate_commit_msg(args: tuple[str, ...]) -> None:
     _run_module("devx.ci.validate_commit_msg", list(args))
 
 
+@ci.command("distribute-files")
+@click.argument("args", nargs=-1)
+def ci_distribute_files(args: tuple[str, ...]) -> None:
+    """Distribute files across parallel runners (round-robin)."""
+    _run_module("devx.ci.distribute_files", list(args))
+
+
+@ci.command("merge-junit")
+@click.argument("args", nargs=-1)
+def ci_merge_junit(args: tuple[str, ...]) -> None:
+    """Merge multiple JUnit XML reports into a single report."""
+    _run_module("devx.ci.merge_junit", list(args))
+
+
+@ci.command("integration-guard")
+@click.argument("args", nargs=-1)
+def ci_integration_guard(args: tuple[str, ...]) -> None:
+    """Run pytest with cross-runner failure detection and JUnit output."""
+    _run_module("devx.ci.integration_guard", list(args))
+
+
 @cli.group()
 def tools() -> None:
     """Development tool commands."""
@@ -177,6 +198,13 @@ def tools_generate_badges(args: tuple[str, ...]) -> None:
     _run_module("devx.tools.generate_badges", list(args))
 
 
+@tools.command("generate-cliff-config")
+@click.argument("args", nargs=-1)
+def tools_generate_cliff_config(args: tuple[str, ...]) -> None:
+    """Generate a cliff.toml configuration file for the project."""
+    _run_module("devx.tools.generate_cliff_config", list(args))
+
+
 @tools.command("install-checkmake")
 @click.argument("args", nargs=-1)
 def tools_install_checkmake(args: tuple[str, ...]) -> None:

src/devx/config.py

@@ -13,8 +13,9 @@ import re
 GITEA_API_URL = os.getenv("DEVX_GITEA_API_URL", "https://git.oblachno.oblachno.fyi/api/v1")
 VIKUNJA_API_URL = os.getenv("DEVX_VIKUNJA_API_URL", "https://work.oblachno.oblachno.fyi/api/v1")
 
-# Organization defaults
-REPO_OWNER = os.getenv("DEVX_REPO_OWNER", "oblachno-oss")
+# Organization defaults — each project MUST set DEVX_REPO_OWNER explicitly.
+# No default: prevents silent 404s when the wrong owner is used.
+REPO_OWNER = os.getenv("DEVX_REPO_OWNER", "")
 
 # Task prefix for Vikunja task IDs — each project sets its own (GRM, DEVX, INFRA, etc.)
 TASK_PREFIX = os.getenv("DEVX_TASK_PREFIX", "DEVX")

src/devx/molecule/distribute_molecule.py

@@ -25,10 +25,11 @@ from pathlib import Path
 import click
 
 from devx.i18n import _
-from devx.molecule.platforms import PLATFORMS
+from devx.molecule.platforms import PLATFORMS, load_platforms
 
 DEFAULT_MAX_RUNNERS = 3
 MOLECULE_ROOT = Path("ansible/roles/gitea-runner/molecule")
+DEFAULT_ROLES_ROOT = Path("ansible/roles")
 
 
 @dataclass(frozen=True)
@@ -40,7 +41,8 @@ class TestPair:
 
     def encode(self) -> str:
         """Serialize to a pipe-delimited string for CI consumption."""
-        return f"{self.scenario}|{self.platform['name']}|{self.platform['image']}|{self.platform['command']}"
+        cmd = self.platform["command"].replace(" ", "__SPACE__")
+        return f"{self.scenario}|{self.platform['name']}|{self.platform['image']}|{cmd}"
 
     @staticmethod
     def decode(encoded: str) -> TestPair:
@@ -48,7 +50,31 @@ class TestPair:
         parts = encoded.split("|")
         return TestPair(
             scenario=parts[0],
-            platform={"name": parts[1], "image": parts[2], "command": parts[3]},
+            platform={"name": parts[1], "image": parts[2], "command": parts[3].replace("__SPACE__", " ")},
+        )
+
+
+@dataclass(frozen=True)
+class MultiRoleTestPair:
+    """A (role, scenario, platform) combination for multi-role projects."""
+
+    role: str
+    scenario: str
+    platform: dict[str, str]
+
+    def encode(self) -> str:
+        """Serialize to a pipe-delimited string: ``role|scenario|platform_name|image|command``."""
+        cmd = self.platform["command"].replace(" ", "__SPACE__")
+        return f"{self.role}|{self.scenario}|{self.platform['name']}|{self.platform['image']}|{cmd}"
+
+    @staticmethod
+    def decode(encoded: str) -> MultiRoleTestPair:
+        """Deserialize from a pipe-delimited string."""
+        parts = encoded.split("|")
+        return MultiRoleTestPair(
+            role=parts[0],
+            scenario=parts[1],
+            platform={"name": parts[2], "image": parts[3], "command": parts[4].replace("__SPACE__", " ")},
         )
 
 
@@ -62,6 +88,33 @@ def discover_scenarios(root: Path | None = None) -> list[str]:
     return sorted(scenarios)
 
 
+def discover_multi_role_scenarios(roles_root: Path | None = None) -> list[tuple[str, str]]:
+    """Discover (role, scenario) pairs across all roles under *roles_root*.
+
+    Scans ``roles_root/*/molecule/*/`` for scenario directories, skipping
+    ``common`` and directories starting with ``_``. Returns a sorted list of
+    ``(role_name, scenario_name)`` tuples.
+    """
+    if roles_root is None:
+        roles_root = DEFAULT_ROLES_ROOT
+    if not roles_root.is_dir():
+        raise click.ClickException(_("Roles directory not found: {path}", path=str(roles_root)))
+    pairs: list[tuple[str, str]] = []
+    for role_dir in sorted(roles_root.iterdir()):
+        if not role_dir.is_dir():
+            continue
+        mol_dir = role_dir / "molecule"
+        if not mol_dir.is_dir():
+            continue
+        for scenario_dir in mol_dir.iterdir():
+            if not scenario_dir.is_dir():
+                continue
+            if scenario_dir.name.startswith("_") or scenario_dir.name == "common":
+                continue
+            pairs.append((role_dir.name, scenario_dir.name))
+    return pairs
+
+
 def build_pairs(scenarios: list[str], platforms: list[dict[str, str]] | None = None) -> list[TestPair]:
     """Build the full cross-product of scenarios and platforms."""
     if platforms is None:
@@ -69,6 +122,36 @@ def build_pairs(scenarios: list[str], platforms: list[dict[str, str]] | None = N
     return [TestPair(s, p) for s in scenarios for p in platforms]
 
 
+def build_multi_role_pairs(
+    role_scenarios: list[tuple[str, str]],
+    platforms: list[dict[str, str]] | None = None,
+) -> list[MultiRoleTestPair]:
+    """Build the full cross-product of (role, scenario) pairs and platforms."""
+    if platforms is None:
+        platforms = PLATFORMS
+    return [MultiRoleTestPair(r, s, p) for r, s in role_scenarios for p in platforms]
+
+
+def distribute_multi_role(pairs: list[MultiRoleTestPair], max_runners: int) -> list[list[MultiRoleTestPair]]:
+    """Split *pairs* into *max_runners* balanced groups (round-robin)."""
+    groups: list[list[MultiRoleTestPair]] = [[] for _ in range(max_runners)]
+    for i, pair in enumerate(pairs):
+        groups[i % max_runners].append(pair)
+    return groups
+
+
+def multi_role_pairs_for_runner(
+    pairs: list[MultiRoleTestPair], runner_index: int, max_runners: int
+) -> list[MultiRoleTestPair]:
+    """Return the subset of multi-role pairs assigned to *runner_index* (0-based)."""
+    groups = distribute_multi_role(pairs, max_runners)
+    if runner_index < 0 or runner_index >= len(groups):
+        raise click.ClickException(
+            _("Runner index {index} out of range (0..{max})", index=runner_index, max=max_runners - 1)
+        )
+    return groups[runner_index]
+
+
 def distribute(pairs: list[TestPair], max_runners: int) -> list[list[TestPair]]:
     """Split *pairs* into *max_runners* balanced groups (round-robin)."""
     groups: list[list[TestPair]] = [[] for _ in range(max_runners)]
@@ -142,6 +225,26 @@ def _write_github_env(key: str, value: str) -> None:
     default=False,
     help="With --github-env: write SKIP=true when runner-index exceeds max-runners.",
 )
+@click.option(
+    "--molecule-root",
+    type=click.Path(exists=True, file_okay=False, path_type=Path),
+    default=None,
+    help="Custom molecule directory (single-role mode). Default: ansible/roles/gitea-runner/molecule.",
+)
+@click.option(
+    "--roles-root",
+    type=click.Path(exists=True, file_okay=False, path_type=Path),
+    default=None,
+    help="Roles directory for multi-role discovery (scans */molecule/*/). "
+    "Use this for projects with multiple Ansible roles. Default: disabled (single-role mode).",
+)
+@click.option(
+    "--platforms-file",
+    type=click.Path(exists=True, file_okay=True, path_type=Path),
+    default=None,
+    help="JSON file with custom platform list (each entry: name, image, command). "
+    "Overrides the default platform matrix. Useful for projects with custom test images.",
+)
 def cli(
     runner_index: int | None,
     max_runners: int,
@@ -149,17 +252,58 @@ def cli(
     list_platforms: bool,
     github_env: bool,
     skip_if_excess: bool,
+    molecule_root: Path | None,
+    roles_root: Path | None,
+    platforms_file: Path | None,
 ) -> None:
-    scenarios = discover_scenarios()
+    platforms = load_platforms(platforms_file)
+    # Multi-role mode: discover (role, scenario) pairs across all roles
+    if roles_root is not None:
+        role_scenarios = discover_multi_role_scenarios(roles_root)
+        if list_all:
+            for role, scenario in role_scenarios:
+                click.echo(f"{role}|{scenario}")
+            return
+        if list_platforms:
+            for p in platforms:
+                click.echo(f"{p['name']}|{p['image']}|{p['command']}")
+            return
+        pairs_mr = build_multi_role_pairs(role_scenarios, platforms)
+        if runner_index is None:
+            groups = distribute_multi_role(pairs_mr, max_runners)
+            for i, group in enumerate(groups):
+                labels = " ".join(p.encode() for p in group) if group else "(none)"
+                click.echo(f"Runner {i}: {labels}")
+            return
+        if skip_if_excess and github_env and runner_index > max_runners:
+            click.echo(f"Skipping — runner index {runner_index} > max runners {max_runners}")
+            _write_github_env("TEST_PAIRS", "")
+            _write_github_env("SKIP", "true")
+            return
+        if runner_index < 1:
+            raise click.ClickException(f"Runner index {runner_index} is out of range (must be >= 1)")
+        zero_based = runner_index - 1
+        assigned = multi_role_pairs_for_runner(pairs_mr, zero_based, max_runners)
+        encoded = " ".join(p.encode() for p in assigned)
+        if github_env:
+            _write_github_env("TEST_PAIRS", encoded)
+            _write_github_env("SKIP", "false")
+            click.echo(f"Assigned pairs: {encoded}")
+            return
+        click.echo(encoded)
+        return
+
+    # Single-role mode (default or --molecule-root)
+    scenarios = discover_scenarios(molecule_root)
     if list_all:
         for s in scenarios:
             click.echo(s)
         return
     if list_platforms:
-        for p in PLATFORMS:
+        for p in platforms:
             click.echo(f"{p['name']}|{p['image']}|{p['command']}")
         return
-    pairs = build_pairs(scenarios)
+    pairs = build_pairs(scenarios, platforms)
     if runner_index is None:
         groups = distribute(pairs, max_runners)
         for i, group in enumerate(groups):

src/devx/molecule/molecule_ci_guard.py

@@ -1,7 +1,11 @@
 #!/usr/bin/env python3
 """Run molecule tests sequentially while polling Gitea for other runner failures.
 
-Each pair is encoded as ``scenario|platform_name|platform_image|platform_command``.
+Each pair is encoded as one of:
+
+- **Single-role (4-part):** ``scenario|platform_name|platform_image|platform_command``
+- **Multi-role (5-part):** ``role|scenario|platform_name|platform_image|platform_command``
+
 Pairs are executed one at a time (molecule scenarios share temp directories and
 Docker networks, so parallel execution within a single runner is unsafe).
 
@@ -9,8 +13,17 @@ A background thread polls the Gitea API. If any other molecule matrix runner
 reports failure, the current molecule subprocess is killed and this runner
 exits early with code 1.
 
-Usage:
-    python3 -m devx.molecule.molecule_ci_guard <pair1> <pair2> ...
+JUnit XML is generated when ``--junit-output`` is provided, recording each
+pair as a testcase with pass/fail status and elapsed time.
+
+Usage::
+
+    # Single-role (grm-style)
+    python3 -m devx.molecule.molecule_ci_guard pair1 pair2 ...
+    # Multi-role (infra-style)
+    python3 -m devx.molecule.molecule_ci_guard --roles-root ansible/roles pair1 pair2 ...
+    # With JUnit output
+    python3 -m devx.molecule.molecule_ci_guard --junit-output junit-results/runner-1.xml pair1 pair2 ...
 
 Environment variables:
     GITEA_URL           Base URL of the Gitea instance.
@@ -30,6 +43,7 @@ import subprocess  # nosec B404
 import sys
 import threading
 import time
+import xml.etree.ElementTree as ET  # nosec B405
 from pathlib import Path
 
 import click
@@ -95,9 +109,25 @@ def build_molecule_cmd(scenario: str) -> list[str]:
     return cmd
 
 
+def parse_pair(pair: str) -> tuple[str, str, str, str, str]:
+    """Parse a pair string into (role, scenario, platform_name, platform_image, platform_command).
+
+    Supports both 4-part (single-role) and 5-part (multi-role) formats.
+    For 4-part pairs, role is empty (caller uses default role dir).
+    Spaces in the command field are encoded as ``__SPACE__`` to survive
+    shell word-splitting when ``$TEST_PAIRS`` is expanded unquoted.
+    """
+    parts = pair.split("|")
+    if len(parts) == 4:
+        return "", parts[0], parts[1], parts[2], parts[3].replace("__SPACE__", " ")
+    if len(parts) == 5:
+        return parts[0], parts[1], parts[2], parts[3], parts[4].replace("__SPACE__", " ")
+    raise click.ClickException(f"Invalid pair format: {pair!r} (expected 4 or 5 pipe-delimited parts)")
+
+
 def build_env_for_pair(pair: str, base_env: dict[str, str]) -> dict[str, str]:
     """Build environment for a single molecule pair."""
-    scenario, platform_name, platform_image, platform_command = pair.split("|")
+    _role, _scenario, platform_name, platform_image, platform_command = parse_pair(pair)
     env = base_env.copy()
     env["MOLECULE_PLATFORM_NAME"] = platform_name
     env["MOLECULE_PLATFORM_IMAGE"] = platform_image
@@ -106,12 +136,75 @@ def build_env_for_pair(pair: str, base_env: dict[str, str]) -> dict[str, str]:
     elif "MOLECULE_PLATFORM_COMMAND" in env:
         del env["MOLECULE_PLATFORM_COMMAND"]
     env["ANSIBLE_ALLOW_BROKEN_CONDITIONALS"] = "true"
+    # Use a fresh MOLECULE_HOME per pair to avoid stale config cache
+    # from previous CI runs (causes "Instances missing" errors).
+    if "MOLECULE_HOME" not in env:
+        import tempfile
+
+        env["MOLECULE_HOME"] = tempfile.mkdtemp(prefix="molecule-ci-")
     return env
 
 
+def resolve_role_dir(role: str, roles_root: Path | None, repo_root: Path) -> Path:
+    """Resolve the working directory for a molecule pair.
+
+    For multi-role pairs (role non-empty), uses ``roles_root/role``.
+    For single-role pairs, uses ``repo_root/ansible/roles/gitea-runner``.
+    """
+    if role:
+        if roles_root is None:
+            roles_root = repo_root / "ansible" / "roles"
+        return roles_root / role
+    return repo_root / "ansible" / "roles" / "gitea-runner"
+
+
+def write_junit_report(
+    output_path: str,
+    testcases: list[dict],
+    runner_index: int,
+) -> None:
+    """Write a JUnit XML report from collected test case results.
+
+    Each testcase dict has: role, scenario, time (float), passed (bool), error (str|None).
+    """
+    suite = ET.Element(
+        "testsuite",
+        name=f"molecule-runner-{runner_index}",
+        tests=str(len(testcases)),
+        failures=str(sum(1 for tc in testcases if not tc["passed"])),
+    )
+    for tc in testcases:
+        classname = tc["role"] if tc["role"] else "molecule"
+        elem = ET.SubElement(
+            suite,
+            "testcase",
+            classname=classname,
+            name=tc["scenario"],
+            time=f"{tc['time']:.1f}",
+        )
+        if not tc["passed"]:
+            fail = ET.SubElement(elem, "failure")
+            fail.text = tc.get("error") or "molecule test failed"
+    tree = ET.ElementTree(suite)
+    ET.indent(tree)
+    Path(output_path).parent.mkdir(parents=True, exist_ok=True)
+    tree.write(output_path, encoding="UTF-8", xml_declaration=True)
+
+
 @click.command()
 @click.argument("pairs", nargs=-1, required=True)
-def cli(pairs: tuple[str, ...]) -> None:
+@click.option(
+    "--junit-output",
+    default=None,
+    help="Path to write JUnit XML report (e.g. junit-results/runner-1.xml).",
+)
+@click.option(
+    "--roles-root",
+    type=click.Path(exists=True, file_okay=False, path_type=Path),
+    default=None,
+    help="Root directory for multi-role pairs (e.g. ansible/roles). Required when pairs use 5-part format.",
+)
+def cli(pairs: tuple[str, ...], junit_output: str | None, roles_root: Path | None) -> None:
     """Run molecule pairs sequentially, stop if another CI runner fails."""
     gitea_url = os.environ.get("GITEA_URL", "")
     token = os.environ.get("REPO_TOKEN", "")
@@ -119,15 +212,17 @@ def cli(pairs: tuple[str, ...]) -> None:
     job_name = os.environ.get("JOB_NAME", "molecule-tests")
     current_index = int(os.environ.get("MATRIX_INDEX", "0"))
     repository = os.environ.get("GITEA_REPOSITORY", "oblachno-oss/devx")
-    owner, sep, repo = repository.partition("/")
+    owner, _sep, repo = repository.partition("/")
     if not owner or not repo:
         owner, repo = "oblachno-oss", "devx"
 
     if not all([gitea_url, token, run_id]):
         click.echo(_("GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation."))
 
-    repo_root = Path(__file__).resolve().parent.parent.parent.parent
-    role_dir = repo_root / "ansible" / "roles" / "gitea-runner"
+    # When devx is installed as a pip package, __file__ resolves to the
+    # site-packages directory, not the repo root. Use GITHUB_WORKSPACE
+    # (set by Gitea Actions) or cwd as the repo root.
+    repo_root = Path(os.environ.get("GITHUB_WORKSPACE", os.getcwd())).resolve()
 
     base_env = os.environ.copy()
     base_env.setdefault("DOCKER_HOST", f"unix:///run/user/{os.getuid()}/docker.sock")
@@ -154,24 +249,24 @@ def cli(pairs: tuple[str, ...]) -> None:
         )
         poller.start()
 
+    testcases: list[dict] = []
+
     try:
         for pair in pairs:
             if failed_event.is_set():
                 sys.exit(1)
 
-            parts = pair.split("|")
-            if len(parts) < 2:
-                raise click.ClickException(f"Invalid pair format: {pair!r} (expected at least 2 pipe-delimited parts)")
-            scenario = parts[0]
-            platform_name = parts[1]
+            role, scenario, platform_name, _img, _cmd = parse_pair(pair)
             click.echo(_("Running: {scenario} on {platform}", scenario=scenario, platform=platform_name))
 
             cmd = build_molecule_cmd(scenario)
             env = build_env_for_pair(pair, base_env)
+            cwd = resolve_role_dir(role, roles_root, repo_root)
 
+            start = time.time()
             process = subprocess.Popen(  # nosec B603
                 cmd,
-                cwd=str(role_dir),
+                cwd=str(cwd),
                 env=env,
                 preexec_fn=os.setsid,
             )
@@ -187,6 +282,18 @@ def cli(pairs: tuple[str, ...]) -> None:
                             with contextlib.suppress(ProcessLookupError):
                                 os.killpg(os.getpgid(process.pid), signal.SIGKILL)
                             process.wait()
+                        elapsed = time.time() - start
+                        testcases.append(
+                            {
+                                "role": role,
+                                "scenario": scenario,
+                                "time": elapsed,
+                                "passed": False,
+                                "error": "Cancelled — another runner failed",
+                            }
+                        )
+                        if junit_output:
+                            write_junit_report(junit_output, testcases, current_index)
                         sys.exit(1)
                     time.sleep(1)
             except KeyboardInterrupt:
@@ -196,13 +303,41 @@ def cli(pairs: tuple[str, ...]) -> None:
                 sys.exit(1)
 
             rc = process.returncode
+            elapsed = time.time() - start
+            passed = rc == 0
+
+            testcases.append(
+                {
+                    "role": role,
+                    "scenario": scenario,
+                    "time": elapsed,
+                    "passed": passed,
+                    "error": f"Exit code: {rc}" if not passed else None,
+                }
+            )
+
             if rc != 0:
                 click.echo(_("FAILED: {pair} exited with code {code}", pair=pair, code=rc))
+                if junit_output:
+                    write_junit_report(junit_output, testcases, current_index)
                 sys.exit(rc)
 
             click.echo(_("PASSED: {pair}", pair=pair))
 
+            # Prune Docker data between scenarios to prevent disk exhaustion
+            # in Docker-in-Docker molecule containers (each scenario pulls
+            # hundreds of MB of images that accumulate across pairs).
+            with contextlib.suppress(subprocess.SubprocessError, OSError):
+                subprocess.run(  # nosec B603, B607
+                    ["docker", "system", "prune", "-af", "--volumes"],
+                    check=False,
+                    capture_output=True,
+                    timeout=60,
+                )
+
         click.echo(_("All molecule tests passed."))
+        if junit_output:
+            write_junit_report(junit_output, testcases, current_index)
     finally:
         stop_event.set()
 

src/devx/molecule/platforms.py

@@ -10,13 +10,39 @@ dev tools and CI scripts.
 
 from __future__ import annotations
 
-#: Supported OS platform matrix.
+import json
+from pathlib import Path
+
+#: Default supported OS platform matrix.
 #: Each entry maps a short name to (image, command).
-#: The command must be systemd since rootless Docker requires
-#: loginctl/systemctl --user.
+#: Uses the project's pre-built molecule-test-base image with
+#: ``sleep infinity`` (NOT systemd) to avoid cgroup v2 failures.
 PLATFORMS: list[dict[str, str]] = [
-    {"name": "ubuntu-2204", "image": "geerlingguy/docker-ubuntu2204-ansible:latest", "command": "/lib/systemd/systemd"},
-    {"name": "ubuntu-2404", "image": "geerlingguy/docker-ubuntu2404-ansible:latest", "command": "/lib/systemd/systemd"},
-    {"name": "debian-12", "image": "geerlingguy/docker-debian12-ansible:latest", "command": "/lib/systemd/systemd"},
-    {"name": "archlinux", "image": "marcstraube/archlinux-ansible:latest", "command": "/usr/lib/systemd/systemd"},
+    {
+        "name": "ubuntu-2604",
+        "image": "git.oblachno.oblachno.fyi/oblachno/molecule-test-base:latest",
+        "command": "sleep infinity",
+    },
 ]
+
+
+def load_platforms(platforms_file: str | Path | None = None) -> list[dict[str, str]]:
+    """Load platforms from a JSON file, falling back to PLATFORMS.
+
+    Args:
+        platforms_file: Path to a JSON file with a list of platform dicts.
+            Each dict must have ``name``, ``image``, and ``command`` keys.
+
+    Returns:
+        List of platform dictionaries.
+    """
+    if platforms_file is None:
+        return PLATFORMS
+    path = Path(platforms_file)
+    if not path.is_file():
+        return PLATFORMS
+    with path.open() as f:
+        data = json.load(f)
+    if not isinstance(data, list) or not data:
+        return PLATFORMS
+    return data

src/devx/molecule/start_docker.py

@@ -0,0 +1,202 @@
+#!/usr/bin/env python3
+"""Ensure Docker is available for molecule tests in CI.
+
+CI runners (e.g. ``gitea/runner-images:ubuntu-latest``) may have the host's
+Docker socket mounted. This module verifies Docker is accessible and
+sets ``DOCKER_HOST`` explicitly so molecule's Python docker library
+connects to the same socket as the Docker CLI.
+
+If the host socket is not available, it tries the rootless socket, then
+starts a local ``dockerd`` with the vfs storage driver (requires
+privileged container).
+
+Usage::
+
+    python3 -m devx.molecule.start_docker [--timeout 30]
+"""
+
+from __future__ import annotations
+
+import glob
+import os
+import subprocess  # nosec B404
+import sys
+import tempfile
+import time
+
+import click
+
+from devx.i18n import _
+
+DEFAULT_TIMEOUT = 30
+DOCKER_SOCK = "/var/run/docker.sock"
+# Rootless socket fallback (e.g. /run/user/994/docker.sock)
+ROOTLESS_SOCK = f"/run/user/{os.getuid()}/docker.sock"
+
+
+def is_docker_ready() -> bool:
+    """Check if Docker daemon is responding on the configured socket."""
+    docker_host = os.environ.get("DOCKER_HOST", f"unix://{DOCKER_SOCK}")
+    result = subprocess.run(  # nosec B603 B607
+        ["docker", "info"],
+        capture_output=True,
+        check=False,
+        env={**os.environ, "DOCKER_HOST": docker_host},
+    )
+    return result.returncode == 0
+
+
+def _diagnose_socket() -> None:
+    """Print diagnostic info about the Docker socket."""
+    click.echo(f"DOCKER_HOST = {os.environ.get('DOCKER_HOST', '(not set)')}")
+    click.echo(f"Socket path: {DOCKER_SOCK}")
+    click.echo(f"Socket exists: {os.path.exists(DOCKER_SOCK)}")
+    if os.path.exists(DOCKER_SOCK):
+        stat = os.stat(DOCKER_SOCK)
+        click.echo(f"Socket mode: {oct(stat.st_mode)}")
+        click.echo(f"Socket uid: {stat.st_uid}, gid: {stat.st_gid}")
+    # Check if it's a mount point
+    result = subprocess.run(  # nosec B603 B607
+        ["mount"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    docker_mounts = [line for line in result.stdout.splitlines() if "docker" in line.lower()]
+    if docker_mounts:
+        click.echo("Docker-related mounts:")
+        for line in docker_mounts:
+            click.echo(f"  {line}")
+    else:
+        click.echo("No Docker-related mounts found")
+    # Check docker context
+    result = subprocess.run(  # nosec B603 B607
+        ["docker", "context", "ls"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    click.echo(f"Docker contexts:\n{result.stdout}")
+    # Try docker info without DOCKER_HOST
+    result = subprocess.run(  # nosec B603 B607
+        ["docker", "info"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    click.echo(f"docker info (no DOCKER_HOST): rc={result.returncode}")
+    if result.returncode != 0:
+        click.echo(f"  stderr: {result.stderr[:500]}")
+    else:
+        # Print server version and storage driver
+        for line in result.stdout.splitlines():
+            if "Server Version" in line or "Storage Driver" in line or "Docker Root Dir" in line:
+                click.echo(f"  {line.strip()}")
+
+
+def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
+    """Ensure Docker is ready for molecule tests.
+
+    First tries the host socket. If that works, sets ``DOCKER_HOST`` and
+    returns immediately. If not, tries the rootless socket. If neither
+    works, starts a local ``dockerd`` with vfs storage driver (requires
+    privileged container).
+
+    Returns ``True`` if Docker is ready, ``False`` if it failed to
+    start within the timeout.
+    """
+    # Point Docker CLI and Python library to the socket explicitly
+    os.environ["DOCKER_HOST"] = f"unix://{DOCKER_SOCK}"
+
+    # Diagnose socket state
+    click.echo("--- Docker socket diagnostics ---")
+    _diagnose_socket()
+    click.echo("--- End diagnostics ---")
+
+    # Check if host Docker is already available
+    if is_docker_ready():
+        click.echo(_("Docker daemon already running"))
+        return True
+
+    # Try rootless socket (e.g. /run/user/994/docker.sock)
+    click.echo(f"Trying rootless socket: {ROOTLESS_SOCK}")
+    os.environ["DOCKER_HOST"] = f"unix://{ROOTLESS_SOCK}"
+    if os.path.exists(ROOTLESS_SOCK) and is_docker_ready():
+        click.echo(_("Docker daemon already running"))
+        return True
+
+    # Scan for any rootless sockets at other UIDs
+    for sock in sorted(glob.glob("/run/user/*/docker.sock")):
+        if sock == ROOTLESS_SOCK:
+            continue
+        click.echo(f"Trying alternative rootless socket: {sock}")
+        os.environ["DOCKER_HOST"] = f"unix://{sock}"
+        if is_docker_ready():
+            click.echo(_("Docker daemon already running"))
+            return True
+
+    click.echo(_("Host Docker not available, starting local dockerd..."))
+
+    # Reset DOCKER_HOST to host socket for local dockerd
+    os.environ["DOCKER_HOST"] = f"unix://{DOCKER_SOCK}"
+
+    # Start local dockerd (requires privileged container)
+    log_file = tempfile.NamedTemporaryFile(  # noqa: SIM115
+        mode="w", suffix="dockerd.log", delete=False
+    )
+    click.echo(f"dockerd log: {log_file.name}")
+    subprocess.Popen(  # nosec B603 B607
+        [
+            "dockerd",
+            "--storage-driver",
+            "vfs",
+            "-H",
+            f"unix://{DOCKER_SOCK}",
+        ],
+        stdout=log_file,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+    )
+
+    for _i in range(timeout):
+        if is_docker_ready():
+            click.echo(_("Docker daemon started"))
+            return True
+        time.sleep(1)
+
+    # Print dockerd log on failure
+    click.echo(_("Docker daemon failed to start"))
+    click.echo("--- dockerd log ---")
+    try:
+        with open(log_file.name) as f:
+            log_content = f.read()
+        click.echo(log_content[-3000:] if len(log_content) > 3000 else log_content)
+    except OSError as e:
+        click.echo(f"Could not read log: {e}")
+    click.echo("--- End dockerd log ---")
+
+    return False
+
+
+@click.command()
+@click.option(
+    "--timeout",
+    default=DEFAULT_TIMEOUT,
+    type=int,
+    help="Seconds to wait for Docker daemon to start (default: 30).",
+)
+def main(timeout: int) -> None:
+    """Start Docker daemon for CI molecule tests."""
+    if start_docker_daemon(timeout):
+        # Export DOCKER_HOST to GITHUB_ENV for subsequent CI steps
+        github_env = os.environ.get("GITHUB_ENV")
+        if github_env and os.environ.get("DOCKER_HOST"):
+            with open(github_env, "a") as f:
+                f.write(f"DOCKER_HOST={os.environ['DOCKER_HOST']}\n")
+            click.echo(f"Exported DOCKER_HOST={os.environ['DOCKER_HOST']} to GITHUB_ENV")
+        sys.exit(0)
+    sys.exit(1)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

src/devx/opentofu.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""OpenTofu output helpers for CI/CD deployment scripts.
+
+Provides reusable functions for extracting values from ``tofu output``
+in a structured way.  This eliminates duplicated ``subprocess.run``
+boilerplate across deployment and smoke-test scripts.
+
+Typical usage::
+
+    from devx.opentofu import get_tofu_output, get_tofu_vm_ip
+
+    vms = get_tofu_output("customer_vms", cwd="tofu/environments/staging",
+                          env={"HCLOUD_TOKEN": token})
+    ip = get_tofu_vm_ip("customer_vms", "oblachno", cwd="tofu/environments/staging",
+                        env={"HCLOUD_TOKEN": token})
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess  # nosec B404
+from pathlib import Path
+from typing import Any
+
+
+def get_tofu_output(
+    output_name: str,
+    cwd: str | Path | None = None,
+    env: dict[str, str] | None = None,
+) -> Any:
+    """Run ``tofu output -json <output_name>`` and return parsed JSON.
+
+    Args:
+        output_name: The OpenTofu output name to query (e.g. ``customer_vms``).
+        cwd: Directory to run the command in (the tofu env directory).
+        env: Environment variables for the subprocess (e.g. ``{"HCLOUD_TOKEN": ...}``).
+             If ``None``, inherits the current environment.
+
+    Returns:
+        Parsed JSON value from the tofu output.
+
+    Raises:
+        RuntimeError: If ``tofu output`` exits with a non-zero code.
+        json.JSONDecodeError: If stdout is not valid JSON.
+    """
+    result = subprocess.run(  # nosec B603, B607
+        ["tofu", "output", "-json", output_name],
+        cwd=str(cwd) if cwd else None,
+        capture_output=True,
+        text=True,
+        check=False,
+        env=env,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(f"tofu output failed: {result.stderr}")
+    return json.loads(result.stdout)
+
+
+def get_tofu_vm_ip(
+    output_name: str,
+    vm_key: str,
+    cwd: str | Path | None = None,
+    env: dict[str, str] | None = None,
+    ip_field: str = "ipv4",
+) -> str:
+    """Extract a VM IPv4 address from a tofu output map.
+
+    The output is expected to be a JSON object mapping VM names to objects
+    containing an IP field (default ``ipv4``)::
+
+        {"staging": {"ipv4": "1.2.3.4", ...}, ...}
+
+    Args:
+        output_name: The tofu output name (e.g. ``customer_vms``).
+        vm_key: The key inside the output map (e.g. ``"staging"``).
+        cwd: Directory to run the command in.
+        env: Environment variables for the subprocess.
+        ip_field: The field name for the IP address (default ``ipv4``).
+
+    Returns:
+        The IP address string, or empty string if not found.
+    """
+    data = get_tofu_output(output_name, cwd=cwd, env=env)
+    if not isinstance(data, dict):
+        return ""
+    return str(data.get(vm_key, {}).get(ip_field, ""))
+
+
+def get_tofu_vm_field(
+    output_name: str,
+    vm_key: str,
+    field: str,
+    cwd: str | Path | None = None,
+    env: dict[str, str] | None = None,
+) -> str:
+    """Extract an arbitrary field from a VM entry in tofu output.
+
+    Like :func:`get_tofu_vm_ip` but for any field (e.g. ``volume_linux_device``).
+
+    Args:
+        output_name: The tofu output name.
+        vm_key: The key inside the output map.
+        field: The field name to extract.
+        cwd: Directory to run the command in.
+        env: Environment variables for the subprocess.
+
+    Returns:
+        The field value as a string, or empty string if not found.
+    """
+    data = get_tofu_output(output_name, cwd=cwd, env=env)
+    if not isinstance(data, dict):
+        return ""
+    return str(data.get(vm_key, {}).get(field, ""))

src/devx/tools/check_test_speed.py

@@ -1,12 +1,21 @@
 #!/usr/bin/env python3
-"""Run unit tests and enforce a maximum execution-time budget.
+"""Run unit tests and enforce execution-time budgets.
+
+Checks two quality gates:
+1. **Total suite time** must not exceed ``--max-seconds``.
+2. **Per-test time** — no individual test may exceed ``--max-single-seconds``.
 
 Usage:
-  python3 -m devx.tools.check_test_speed [--max-seconds N]
+  python3 -m devx.tools.check_test_speed [--max-seconds N] [--max-single-seconds S]
+
+The module runs ``make test-unit`` with ``PYTEST_ADDOPTS=--durations=0`` so
+that pytest emits per-test timing lines alongside the summary.  Both the
+total wall-clock time and individual test durations are parsed and validated.
 """
 
 from __future__ import annotations
 
+import os
 import re
 import subprocess  # nosec B404
 
@@ -14,18 +23,32 @@ import click
 
 from devx.i18n import _
 
-DEFAULT_MAX_SECONDS = 2.0
+DEFAULT_MAX_SECONDS = 10.0
+DEFAULT_MAX_SINGLE_SECONDS = 0.5
 TEST_COMMAND = ["make", "test-unit"]
+
+# Matches pytest summary line: "234 passed in 0.70s"
 _TIMING_RE = re.compile(r"(\d+) passed.* in ([0-9.]+)s")
 
+# Matches per-test duration lines from --durations=0:
+#   0.51s call     tests/test_foo.py::test_bar
+_DURATION_LINE_RE = re.compile(r"^(\d+\.?\d*)s\s+(?:setup|call|teardown)\s+(.+)$")
+
 
 def run_tests() -> tuple[str, str]:
-    """Execute the unit-test suite and return (stdout, stderr)."""
+    """Execute the unit-test suite and return (stdout, stderr).
+
+    Sets ``PYTEST_ADDOPTS=--durations=0`` so pytest emits per-test timings.
+    """
+    env = os.environ.copy()
+    existing = env.get("PYTEST_ADDOPTS", "")
+    env["PYTEST_ADDOPTS"] = f"--durations=0 {existing}".strip()
     result = subprocess.run(  # nosec B603
         TEST_COMMAND,
         capture_output=True,
         text=True,
         check=False,
+        env=env,
     )
     return result.stdout, result.stderr
 
@@ -43,8 +66,23 @@ def parse_duration(output: str) -> float:
     raise click.ClickException(_("Could not parse test execution time from output."))
 
 
+def parse_per_test_durations(output: str) -> list[tuple[str, float]]:
+    """Extract per-test timings from ``--durations=0`` output.
+
+    Returns a list of ``(test_name, seconds)`` tuples sorted by duration
+    (slowest first).
+    """
+    durations: list[tuple[str, float]] = []
+    for line in output.splitlines():
+        match = _DURATION_LINE_RE.match(line.strip())
+        if match:
+            durations.append((match.group(2).strip(), float(match.group(1))))
+    durations.sort(key=lambda x: x[1], reverse=True)
+    return durations
+
+
 def check_speed(duration: float, max_seconds: float) -> None:
-    """Validate duration is within budget; raise on violation."""
+    """Validate total duration is within budget; raise on violation."""
     if duration > max_seconds:
         raise click.ClickException(
             _(
@@ -57,19 +95,58 @@ def check_speed(duration: float, max_seconds: float) -> None:
         )
 
 
-def main(max_seconds: float) -> None:
-    """Run tests, parse timing, and enforce the budget."""
+def check_per_test_speed(
+    durations: list[tuple[str, float]],
+    max_single_seconds: float,
+) -> list[str]:
+    """Return a list of violation messages for tests exceeding the per-test limit.
+
+    An empty list means all tests are within budget.
+    """
+    violations: list[str] = []
+    for name, elapsed in durations:
+        if elapsed > max_single_seconds:
+            violations.append(
+                _(
+                    "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). "
+                    "Optimise: use lighter fixtures, reduce I/O, or mock external calls.",
+                    name=name,
+                    elapsed=elapsed,
+                    limit=max_single_seconds,
+                )
+            )
+    return violations
+
+
+def main(max_seconds: float, max_single_seconds: float) -> None:
+    """Run tests, parse timings, and enforce both budgets."""
     stdout, stderr = run_tests()
     combined = stdout + "\n" + stderr
     click.echo(combined, err=False)
 
     duration = parse_duration(combined)
     check_speed(duration, max_seconds)
+
+    if max_single_seconds > 0:
+        per_test = parse_per_test_durations(combined)
+        violations = check_per_test_speed(per_test, max_single_seconds)
+        if violations:
+            msg = _(
+                "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
+                count=len(violations),
+                limit=max_single_seconds,
+            )
+            click.echo(f"\n{msg}", err=True)
+            for v in violations:
+                click.echo(f"  - {v}", err=True)
+            raise click.ClickException(msg)
+
     click.echo(
         _(
-            "Unit tests passed in {duration:.2f}s (under {max}s limit).",
+            "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
             duration=duration,
             max=max_seconds,
+            single=max_single_seconds,
         )
     )
 
@@ -80,10 +157,17 @@ def main(max_seconds: float) -> None:
     type=float,
     default=DEFAULT_MAX_SECONDS,
     show_default=True,
-    help="Maximum allowed execution time in seconds.",
+    help="Maximum allowed total execution time in seconds.",
 )
-def cli(max_seconds: float) -> None:
-    main(max_seconds)
+@click.option(
+    "--max-single-seconds",
+    type=float,
+    default=DEFAULT_MAX_SINGLE_SECONDS,
+    show_default=True,
+    help="Maximum allowed per-test time in seconds (0 to disable).",
+)
+def cli(max_seconds: float, max_single_seconds: float) -> None:
+    main(max_seconds, max_single_seconds)
 
 
 if __name__ == "__main__":  # pragma: no cover

src/devx/tools/configure_repo.py

@@ -155,6 +155,19 @@ def main(repo: str | None, owner: str | None, branch: str, api_url: str | None)
     if not repo:
         raise click.ClickException(_("ERROR: Repository name not specified. Use --repo or set DEVX_REPO_NAME."))
 
+    # If DEVX_REPO_NAME contains a slash (e.g. "oblachno/infra"), split into owner/repo.
+    # This prevents 404s when workflows set DEVX_REPO_NAME to the full path.
+    if "/" in repo and owner is None:
+        parts = repo.split("/", 1)
+        owner, repo = parts[0], parts[1]
+        click.echo(
+            _(
+                "Parsed owner={owner}, repo={repo} from DEVX_REPO_NAME",
+                owner=owner,
+                repo=repo,
+            )
+        )
+
     if owner is None:
         owner = REPO_OWNER
 

src/devx/tools/generate_badges.py

@@ -5,12 +5,21 @@ Runs pytest-cov, doc-coverage, lint checks, and version extraction,
 then writes SVG badge files that can be served as static files from
 the Gitea raw file API.
 
+The repo root is resolved from ``GITHUB_WORKSPACE`` or ``os.getcwd()``,
+so this module works correctly both when run from a source checkout
+and when devx is installed as a pip package in CI.
+
+The package name and coverage target are auto-detected from the
+``src/`` directory structure, making this module reusable across
+all oblachno-oss repos without per-repo configuration.
+
 Usage:
     python3 -m devx.tools.generate_badges --output-dir .badges/
 """
 
 from __future__ import annotations
 
+import os
 import re
 import subprocess  # nosec B404
 import sys
@@ -18,8 +27,7 @@ from pathlib import Path
 
 import click
 
-REPO_ROOT = Path(__file__).resolve().parents[4]
-
+# Coverage regex matches "TOTAL ... NN%" or "TOTAL ... NN.NN%"
 _COVERAGE_RE = re.compile(r"TOTAL.*?(\d+(?:\.\d+)?)%")
 _PASSED_RE = re.compile(r"(\d+) passed")
 _DOC_COVERAGE_RE = re.compile(r"Doc coverage:\s+\d+/\d+\s+\((\d+)%")
@@ -37,18 +45,59 @@ COLOR_HEX: dict[str, str] = {
 }
 
 
-def _find_package_init() -> Path | None:
-    """Find the first package __init__.py under src/ that defines __version__."""
-    src_dir = REPO_ROOT / "src"
-    if not src_dir.exists():
+def resolve_repo_root() -> Path:
+    """Resolve the repository root directory.
+
+    Uses ``GITHUB_WORKSPACE`` env var (set by Gitea Actions) or
+    falls back to ``os.getcwd()``.  This ensures the correct repo
+    root is used even when devx is installed as a pip package.
+    """
+    workspace = os.environ.get("GITHUB_WORKSPACE")
+    if workspace:
+        path = Path(workspace)
+        if path.is_dir():
+            return path
+    return Path.cwd()
+
+
+def detect_package_name(repo_root: Path) -> str | None:
+    """Auto-detect the Python package name from ``src/`` directory.
+
+    Looks for the first subdirectory under ``src/`` that contains
+    an ``__init__.py`` file with ``__version__``.
+
+    Returns the package directory name (e.g., ``devx``,
+    ``gitea_runner_manager``) or ``None`` if no package is found.
+    """
+    src_dir = repo_root / "src"
+    if not src_dir.is_dir():
         return None
-    for init_file in src_dir.rglob("__init__.py"):
-        try:
-            content = init_file.read_text()
-        except OSError:
+    for entry in sorted(src_dir.iterdir()):
+        if not entry.is_dir():
             continue
-        if "__version__" in content:
-            return init_file
+        init_file = entry / "__init__.py"
+        if init_file.exists():
+            return entry.name
+    return None
+
+
+def detect_coverage_target(repo_root: Path) -> str | None:
+    """Auto-detect the pytest-cov target from pyproject.toml.
+
+    Parses ``addopts`` in ``[tool.pytest.ini_options]`` for
+    ``--cov=src/<package>``.  Falls back to ``src/<package>`` if
+    the package is detected but no explicit cov target is found.
+    """
+    pyproject = repo_root / "pyproject.toml"
+    if pyproject.exists():
+        content = pyproject.read_text()
+        match = re.search(r"--cov=(\S+)", content)
+        if match:
+            return match.group(1)
+    # Fallback: derive from package name
+    pkg = detect_package_name(repo_root)
+    if pkg:
+        return f"src/{pkg}"
     return None
 
 
@@ -57,14 +106,15 @@ def _xml_escape(text: str) -> str:
     return text.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;").replace('"', "&quot;")
 
 
-def run_command(cmd: list[str]) -> tuple[int, str, str]:
+def run_command(cmd: list[str], cwd: Path | None = None) -> tuple[int, str, str]:
     """Run a command and return (returncode, stdout, stderr)."""
+    root = str(cwd or resolve_repo_root())
     result = subprocess.run(  # nosec B603
         cmd,
         capture_output=True,
         text=True,
         check=False,
-        cwd=str(REPO_ROOT),
+        cwd=root,
     )
     return result.returncode, result.stdout, result.stderr
 
@@ -139,15 +189,25 @@ def extract_doc_coverage(output: str) -> int | None:
     return None
 
 
-def read_version() -> str:
-    """Read __version__ from the package __init__.py."""
-    init_file = _find_package_init()
-    if init_file is None:
+def read_version(repo_root: Path) -> str:
+    """Read __version__ from the package __init__.py under src/.
+
+    Auto-detects the package directory and reads ``__version__``
+    from its ``__init__.py``.
+    """
+    pkg = detect_package_name(repo_root)
+    if pkg is None:
+        click.echo("  WARNING: No Python package found under src/ — version badge will show 'unknown'")
+        return "unknown"
+    init_file = repo_root / "src" / pkg / "__init__.py"
+    if not init_file.exists():
+        click.echo(f"  WARNING: {init_file} not found — version badge will show 'unknown'")
         return "unknown"
     content = init_file.read_text()
     match = re.search(r'__version__\s*=\s*["\']([^"\']+)["\']', content)
     if match:
         return match.group(1)
+    click.echo(f"  WARNING: No __version__ found in {init_file} — version badge will show 'unknown'")
     return "unknown"
 
 
@@ -179,65 +239,170 @@ def doc_coverage_color(pct: int) -> str:
     return "orange"
 
 
-def generate_badges(output_dir: Path) -> dict[str, dict[str, str | int]]:
-    """Generate all badge SVG files and return badge data as a dict."""
-    badges: dict[str, dict[str, str | int]] = {}
+def detect_testpaths(repo_root: Path) -> list[str]:
+    """Detect test paths from pyproject.toml or filesystem.
 
-    # 1. Code coverage + test count (single pytest-cov run)
-    rc, stdout, stderr = run_command(
-        [
-            sys.executable,
-            "-m",
-            "pytest",
-            "tests/",
-            "-v",
-            "--cov=src/devx",
-            "--cov-report=term-missing",
-            "--cov-fail-under=0",
-        ]
-    )
+    Parses ``testpaths`` in ``[tool.pytest.ini_options]`` from
+    pyproject.toml.  Falls back to ``["tests"]`` if the tests/
+    directory exists.  Returns an empty list if no test paths
+    are found (pytest will use its own defaults).
+    """
+    pyproject = repo_root / "pyproject.toml"
+    if pyproject.exists():
+        content = pyproject.read_text()
+        # Match: testpaths = ["dir1", "dir2"]
+        match = re.search(r"testpaths\s*=\s*\[([^\]]+)\]", content)
+        if match:
+            paths = re.findall(r'["\']([^"\']+)["\']', match.group(1))
+            resolved = []
+            for p in paths:
+                p = p.strip()
+                if (repo_root / p).exists():
+                    resolved.append(p)
+            if resolved:
+                return resolved
+
+    # Fallback: tests/ directory
+    tests_dir = repo_root / "tests"
+    if tests_dir.is_dir():
+        return ["tests"]
+    return []
+
+
+def collect_coverage_and_tests(repo_root: Path) -> tuple[dict[str, str | int], dict[str, str | int]]:
+    """Run pytest-cov and collect coverage + test count badges.
+
+    Returns (coverage_badge, tests_badge).  If pytest is not
+    available or no tests are found, returns 'unknown' badges
+    with a clear warning explaining the failure.
+    """
+    cov_target = detect_coverage_target(repo_root)
+    if cov_target is None:
+        click.echo("  WARNING: No coverage target detected (no src/ package, no --cov in pyproject.toml)")
+        return make_badge("coverage", "unknown", "lightgrey"), make_badge("tests", "unknown", "lightgrey")
+
+    testpaths = detect_testpaths(repo_root)
+    click.echo(f"  Test paths: {testpaths or '(pytest defaults)'}")
+
+    cmd = [
+        sys.executable,
+        "-m",
+        "pytest",
+        *testpaths,
+        "--cov",
+        cov_target,
+        "--cov-report=term-missing",
+        "--cov-fail-under=0",
+        "-q",
+    ]
+    rc, stdout, stderr = run_command(cmd, cwd=repo_root)
     combined = stdout + "\n" + stderr
 
     coverage = extract_coverage(combined)
     if coverage is not None:
-        badges["coverage"] = make_badge("coverage", f"{coverage:.0f}%", coverage_color(coverage))
+        cov_badge = make_badge("coverage", f"{coverage:.0f}%", coverage_color(coverage))
     else:
-        badges["coverage"] = make_badge("coverage", "unknown", "red")
+        click.echo(f"  WARNING: Could not extract coverage from pytest output (rc={rc})")
+        click.echo(f"    pytest stdout (last 300 chars): {stdout.strip()[-300:]}")
+        click.echo(f"    pytest stderr (last 300 chars): {stderr.strip()[-300:]}")
+        cov_badge = make_badge("coverage", "unknown", "red")
 
     test_count = extract_test_count(combined)
     if test_count is not None:
-        badges["tests"] = make_badge("tests", f"{test_count} passing", "brightgreen" if rc == 0 else "red")
+        tests_badge = make_badge("tests", f"{test_count} passing", "brightgreen" if rc == 0 else "red")
     else:
-        badges["tests"] = make_badge("tests", "unknown", "red")
+        click.echo(f"  WARNING: Could not extract test count from pytest output (rc={rc})")
+        click.echo(f"    pytest stdout (last 300 chars): {stdout.strip()[-300:]}")
+        click.echo(f"    pytest stderr (last 300 chars): {stderr.strip()[-300:]}")
+        tests_badge = make_badge("tests", "unknown", "red")
 
-    # 2. Documentation coverage
-    rc, stdout, _ = run_command(
-        [
-            sys.executable,
-            "-m",
-            "devx.ci.doc_coverage",
-        ]
+    return cov_badge, tests_badge
+
+
+def collect_doc_coverage(repo_root: Path) -> dict[str, str | int]:
+    """Run doc_coverage and collect the docs badge."""
+    rc, stdout, stderr = run_command(
+        [sys.executable, "-m", "devx.ci.doc_coverage"],
+        cwd=repo_root,
     )
     doc_pct = extract_doc_coverage(stdout)
     if doc_pct is not None:
-        badges["docs"] = make_badge("docs", f"{doc_pct}%", doc_coverage_color(doc_pct))
-    else:
-        badges["docs"] = make_badge("docs", "unknown", "red")
+        return make_badge("docs", f"{doc_pct}%", doc_coverage_color(doc_pct))
+    click.echo(f"  WARNING: Could not extract doc coverage (rc={rc})")
+    click.echo(f"    stderr: {stderr.strip()[:200]}")
+    return make_badge("docs", "unknown", "red")
 
-    # 3. Code quality (ruff + pyright + bandit all pass)
-    lint_rc, _, _ = run_command([sys.executable, "-m", "ruff", "check", "src/", "tests/"])
-    format_rc, _, _ = run_command([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"])
-    type_rc, _, _ = run_command([sys.executable, "-m", "pyright"])
-    bandit_rc, _, _ = run_command([sys.executable, "-m", "bandit", "-r", "src/"])
 
-    all_pass = all(rc == 0 for rc in [lint_rc, format_rc, type_rc, bandit_rc])
-    badges["quality"] = make_badge("code quality", "A" if all_pass else "F", "brightgreen" if all_pass else "red")
+def collect_quality(repo_root: Path) -> dict[str, str | int]:
+    """Run lint checks and collect the quality badge.
+
+    Runs ruff check, ruff format --check, pyright, and bandit.
+    If any tool is not installed, it is skipped with a warning.
+    """
+    results: list[bool] = []
+    tool_names: list[str] = []
+
+    for cmd, name in [
+        ([sys.executable, "-m", "ruff", "check", "src/", "tests/"], "ruff check"),
+        ([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"], "ruff format"),
+        ([sys.executable, "-m", "pyright"], "pyright"),
+        ([sys.executable, "-m", "bandit", "-r", "src/"], "bandit"),
+    ]:
+        rc, _, stderr = run_command(cmd, cwd=repo_root)
+        if rc == 0:
+            results.append(True)
+            tool_names.append(f"{name}: pass")
+        else:
+            results.append(False)
+            # Distinguish "tool not installed" from "tool found issues"
+            if "No module named" in stderr or "not found" in stderr.lower():
+                click.echo(f"  WARNING: {name} not installed — skipping (counted as pass)")
+                results[-1] = True
+                tool_names.append(f"{name}: not installed (skipped)")
+            else:
+                tool_names.append(f"{name}: FAIL")
+                click.echo(f"  WARNING: {name} failed (rc={rc})")
+                click.echo(f"    stderr: {stderr.strip()[:200]}")
+
+    all_pass = all(results)
+    click.echo(f"  Quality checks: {', '.join(tool_names)}")
+    return make_badge("code quality", "A" if all_pass else "F", "brightgreen" if all_pass else "red")
+
+
+def generate_badges(output_dir: Path, repo_root: Path | None = None) -> dict[str, dict[str, str | int]]:
+    """Generate all badge SVG files and return badge data as a dict.
+
+    Args:
+        output_dir: Directory to write SVG files.
+        repo_root: Repository root (auto-detected if None).
+    """
+    root = repo_root or resolve_repo_root()
+    click.echo(f"  Repo root: {root}")
+    pkg = detect_package_name(root)
+    click.echo(f"  Package: {pkg or 'none'}")
+
+    badges: dict[str, dict[str, str | int]] = {}
+
+    # 1. Code coverage + test count (single pytest-cov run)
+    click.echo("  Collecting coverage and tests...")
+    cov_badge, tests_badge = collect_coverage_and_tests(root)
+    badges["coverage"] = cov_badge
+    badges["tests"] = tests_badge
+
+    # 2. Documentation coverage
+    click.echo("  Collecting doc coverage...")
+    badges["docs"] = collect_doc_coverage(root)
+
+    # 3. Code quality (ruff + pyright + bandit)
+    click.echo("  Collecting code quality...")
+    badges["quality"] = collect_quality(root)
 
     # 4. Version
-    version = read_version()
+    click.echo("  Collecting version...")
+    version = read_version(root)
     badges["version"] = make_badge("version", f"v{version}", "blue")
 
-    # 5. Python version (static but nice)
+    # 5. Python version (static)
     badges["python"] = make_badge("python", "3.12", "blue")
 
     # Write SVG files
@@ -254,14 +419,20 @@ def generate_badges(output_dir: Path) -> dict[str, dict[str, str | int]]:
 @click.command()
 @click.option(
     "--output-dir",
-    default=str(REPO_ROOT / ".badges"),
+    default=".badges",
     help="Directory to write badge SVG files.",
 )
-def cli(output_dir: str) -> None:
+@click.option(
+    "--repo-root",
+    default=None,
+    help="Repository root (auto-detected if not specified).",
+)
+def cli(output_dir: str, repo_root: str | None) -> None:
     """Generate self-contained SVG badge files from project metrics."""
     out = Path(output_dir)
+    root = Path(repo_root) if repo_root else None
     click.echo(f"Generating badges in {out}...")
-    badges = generate_badges(out)
+    badges = generate_badges(out, repo_root=root)
     click.echo(f"\nGenerated {len(badges)} badges:")
     for name, badge in badges.items():
         click.echo(f"  {name}: {badge['label']}={badge['message']} ({badge['color']})")

src/devx/tools/generate_cliff_config.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""Generate a cliff.toml configuration file for a project.
+
+Produces a git-cliff configuration with the correct task ID prefix
+preprocessor, matching the format used by devx itself. Downstream
+repos can use this to avoid duplicating the entire cliff.toml by hand.
+
+Usage::
+
+    python -m devx.tools.generate_cliff_config --prefix GRM
+    python -m devx.tools.generate_cliff_config --prefix GRM --output cliff.toml
+    python -m devx.tools.generate_cliff_config --prefix GRM --force
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import click
+
+from devx.config import TASK_PREFIX
+from devx.i18n import _
+
+# Template uses __PREFIX__ and __PREFIX_REGEX__ as placeholders to avoid
+# conflicts with Jinja2's {{ }} and {% %} syntax in the cliff.toml body.
+CLIFF_TEMPLATE = """\
+# git-cliff configuration for __PREFIX__
+# https://git-cliff.org/docs/configuration
+# Generated by: python -m devx.tools.generate_cliff_config --prefix __PREFIX__
+
+[changelog]
+header = \"\"\"
+# Changelog\\n
+All notable changes to this project will be documented in this file.\\n
+\"\"\"
+body = \"\"\"
+{% if version %}\\
+    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+{% else %}\\
+    ## [unreleased]
+{% endif %}\\
+{% for group, commits in commits | group_by(attribute="group") %}
+    ### {{ group | striptags | trim | upper_first }}
+    {% for commit in commits %}
+        - {% if commit.scope %}*({{ commit.scope }})* {% endif %}\\
+            {% if commit.breaking %}[**breaking**] {% endif %}\\
+            {{ commit.message | upper_first }}\\
+    {% endfor %}
+{% endfor %}
+\"\"\"
+trim = true
+render_always = true
+
+[git]
+conventional_commits = true
+filter_unconventional = true
+require_conventional = false
+split_commits = false
+protect_breaking_commits = false
+filter_commits = false
+fail_on_unmatched_commit = false
+use_branch_tags = false
+topo_order = false
+topo_order_commits = true
+sort_commits = "oldest"
+recurse_submodules = false
+
+commit_preprocessors = [
+    # Strip __PREFIX__-N: task ID prefix from squash-merge commits so git-cliff sees conventional commits
+    { pattern = "^__PREFIX_REGEX__-\\\\d+:\\\\s+", replace = "" },
+]
+
+commit_parsers = [
+    { message = "^feat", group = "<!-- 0 -->Features" },
+    { message = "^fix", group = "<!-- 1 -->Bug Fixes" },
+    { message = "^perf", group = "<!-- 4 -->Performance" },
+    { message = "^refactor", group = "<!-- 2 -->Refactor" },
+    # Skip infrastructure-only commits — they don't affect users
+    { message = "^doc", skip = true },
+    { message = "^test", skip = true },
+    { message = "^style", skip = true },
+    { message = "^chore", skip = true },
+    { message = "^ci", skip = true },
+    # Skip release commits — they are release artifacts, not features
+    { message = "^release:", skip = true },
+    { body = ".*security", group = "<!-- 8 -->Security" },
+    { message = "^revert", group = "<!-- 9 -->Revert" },
+    # Skip anything that doesn't match above — safe default
+    { message = ".*", skip = true },
+]
+
+[bump]
+features_always_bump_minor = true
+breaking_always_bump_major = false
+initial_tag = "0.1.0"
+# Refactor commits bump patch — structural changes to src/ or pyproject.toml
+# affect users even though no new feature was added.
+refactor_always_bump_patch = true
+"""
+
+
+def _generate(prefix: str) -> str:
+    """Generate cliff.toml content for the given prefix."""
+    prefix_regex = prefix.replace("\\", "\\\\")
+    return CLIFF_TEMPLATE.replace("__PREFIX__", prefix).replace("__PREFIX_REGEX__", prefix_regex)
+
+
+@click.command()
+@click.option(
+    "--prefix",
+    default=TASK_PREFIX,
+    help="Task ID prefix for commit preprocessor (default: DEVX_TASK_PREFIX env var or 'DEVX').",
+)
+@click.option(
+    "--output",
+    "-o",
+    default="cliff.toml",
+    type=click.Path(),
+    help="Output file path (default: cliff.toml).",
+)
+@click.option(
+    "--force",
+    is_flag=True,
+    help="Overwrite existing file without prompting.",
+)
+def main(prefix: str, output: str, force: bool) -> None:
+    """Generate a cliff.toml configuration file."""
+    output_path = Path(output)
+
+    if output_path.exists() and not force:
+        raise click.ClickException(
+            _(
+                "{file} already exists. Use --force to overwrite.",
+                file=str(output_path),
+            )
+        )
+
+    content = _generate(prefix)
+    output_path.write_text(content)
+    click.echo(
+        _(
+            "Generated {file} with prefix '{prefix}'.",
+            file=str(output_path),
+            prefix=prefix,
+        )
+    )
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()  # pragma: no cover

src/devx/tools/setup.py

@@ -26,9 +26,24 @@ def _run(cmd: list[str]) -> None:
 
 
 def _install_python_deps(bin_dir: str, extras: str = "dev") -> None:
-    """Install the project with the specified extras in editable mode."""
+    """Install the project with the specified extras in editable mode.
+
+    In CI (system Python with PIP_BREAK_SYSTEM_PACKAGES=1), a first attempt
+    uses --break-system-packages. If that fails (e.g. debian-installed
+    packages without RECORD files), retry with --ignore-installed to skip
+    uninstalling system packages entirely.
+    """
     pip = str(Path(bin_dir) / "pip")
-    _run([pip, "install", "-e", f".[{extras}]"])
+    cmd = [pip, "install", "-e", f".[{extras}]"]
+    if os.environ.get("PIP_BREAK_SYSTEM_PACKAGES") == "1":
+        cmd.append("--break-system-packages")
+    result = subprocess.run(cmd, check=False)  # nosec B603
+    if result.returncode != 0 and os.environ.get("PIP_BREAK_SYSTEM_PACKAGES") == "1":
+        click.echo("  Retrying with --ignore-installed to bypass system packages...")
+        cmd.append("--ignore-installed")
+        _run(cmd)
+    elif result.returncode != 0:
+        raise subprocess.CalledProcessError(result.returncode, cmd)
 
 
 def _install_pre_commit_hooks(bin_dir: str) -> None:
@@ -40,7 +55,7 @@ def _install_pre_commit_hooks(bin_dir: str) -> None:
 
 def _install_ansible_collections(bin_dir: str) -> None:
     """Install required Ansible Galaxy collections if requirements exist."""
-    galaxy = str(Path(bin_dir) / "ansible-galaxy")
+    galaxy = shutil.which("ansible-galaxy") or str(Path(bin_dir) / "ansible-galaxy")
     requirements = Path("ansible/requirements.yml")
     if not requirements.exists():
         click.echo("  ansible/requirements.yml not found — skipping collections.")

src/devx/translations.json

@@ -1,1045 +1,1262 @@
 {
+  "\n=== Summary ===": {
+    "bg": "\n=== Summary ===",
+    "de": "\n=== Summary ===",
+    "en": "\n=== Summary ===",
+    "ru": "\n=== Summary ===",
+    "zh": "\n=== Summary ==="
+  },
   "\nAll documentation coverage checks passed!": {
-    "en": "\nAll documentation coverage checks passed!",
     "bg": "\nAll documentation coverage checks passed!",
     "de": "\nAll documentation coverage checks passed!",
+    "en": "\nAll documentation coverage checks passed!",
     "ru": "\nAll documentation coverage checks passed!",
     "zh": "\nAll documentation coverage checks passed!"
   },
+  "\nCHANGELOG version ordering:": {
+    "bg": "\nCHANGELOG version ordering:",
+    "de": "\nCHANGELOG version ordering:",
+    "en": "\nCHANGELOG version ordering:",
+    "ru": "\nCHANGELOG version ordering:",
+    "zh": "\nCHANGELOG version ordering:"
+  },
   "\nChecking CI script documentation in ci-cd-workflow.md...": {
-    "en": "\nChecking CI script documentation in ci-cd-workflow.md...",
     "bg": "\nChecking CI script documentation in ci-cd-workflow.md...",
     "de": "\nChecking CI script documentation in ci-cd-workflow.md...",
+    "en": "\nChecking CI script documentation in ci-cd-workflow.md...",
     "ru": "\nChecking CI script documentation in ci-cd-workflow.md...",
     "zh": "\nChecking CI script documentation in ci-cd-workflow.md..."
   },
   "\nChecking module documentation in architecture.md...": {
-    "en": "\nChecking module documentation in architecture.md...",
     "bg": "\nChecking module documentation in architecture.md...",
     "de": "\nChecking module documentation in architecture.md...",
+    "en": "\nChecking module documentation in architecture.md...",
     "ru": "\nChecking module documentation in architecture.md...",
     "zh": "\nChecking module documentation in architecture.md..."
   },
   "\nDoc coverage: {covered}/{total} ({pct}%)": {
-    "en": "\nDoc coverage: {covered}/{total} ({pct}%)",
     "bg": "\nDoc coverage: {covered}/{total} ({pct}%)",
     "de": "\nDoc coverage: {covered}/{total} ({pct}%)",
+    "en": "\nDoc coverage: {covered}/{total} ({pct}%)",
     "ru": "\nDoc coverage: {covered}/{total} ({pct}%)",
     "zh": "\nDoc coverage: {covered}/{total} ({pct}%)"
   },
   "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}": {
-    "en": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
     "bg": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
     "de": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
+    "en": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
     "ru": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
     "zh": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}"
   },
   "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.": {
-    "en": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
     "bg": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
     "de": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
+    "en": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
     "ru": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
     "zh": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce."
   },
+  "\nFix the misaligned tags before creating new releases. Run 'python3 -m devx.ci.release --verify' for a full report.": {
+    "bg": "\nFix the misaligned tags before creating new releases. Run 'python3 -m devx.ci.release --verify' for a full report.",
+    "de": "\nFix the misaligned tags before creating new releases. Run 'python3 -m devx.ci.release --verify' for a full report.",
+    "en": "\nFix the misaligned tags before creating new releases. Run 'python3 -m devx.ci.release --verify' for a full report.",
+    "ru": "\nFix the misaligned tags before creating new releases. Run 'python3 -m devx.ci.release --verify' for a full report.",
+    "zh": "\nFix the misaligned tags before creating new releases. Run 'python3 -m devx.ci.release --verify' for a full report."
+  },
   "\nIntegrity check FAILED ({count} issues):": {
-    "en": "\nIntegrity check FAILED ({count} issues):",
     "bg": "\nIntegrity check FAILED ({count} issues):",
     "de": "\nIntegrity check FAILED ({count} issues):",
+    "en": "\nIntegrity check FAILED ({count} issues):",
     "ru": "\nIntegrity check FAILED ({count} issues):",
     "zh": "\nIntegrity check FAILED ({count} issues):"
   },
   "\nIntegrity check passed — all {count} pages verified.": {
-    "en": "\nIntegrity check passed — all {count} pages verified.",
     "bg": "\nIntegrity check passed — all {count} pages verified.",
     "de": "\nIntegrity check passed — all {count} pages verified.",
+    "en": "\nIntegrity check passed — all {count} pages verified.",
     "ru": "\nIntegrity check passed — all {count} pages verified.",
     "zh": "\nIntegrity check passed — all {count} pages verified."
   },
+  "\nLatest tag: {tag}": {
+    "bg": "\nLatest tag: {tag}",
+    "de": "\nLatest tag: {tag}",
+    "en": "\nLatest tag: {tag}",
+    "ru": "\nLatest tag: {tag}",
+    "zh": "\nLatest tag: {tag}"
+  },
   "\nMissing documentation:": {
-    "en": "\nMissing documentation:",
     "bg": "\nMissing documentation:",
     "de": "\nMissing documentation:",
+    "en": "\nMissing documentation:",
     "ru": "\nMissing documentation:",
     "zh": "\nMissing documentation:"
   },
   "\nResult: {status}": {
-    "en": "\nResult: {status}",
     "bg": "\nResult: {status}",
     "de": "\nResult: {status}",
+    "en": "\nResult: {status}",
     "ru": "\nResult: {status}",
     "zh": "\nResult: {status}"
   },
   "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).": {
-    "en": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
     "bg": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
     "de": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
+    "en": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
     "ru": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
     "zh": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments)."
   },
   "\nRunning full wiki integrity check...": {
-    "en": "\nRunning full wiki integrity check...",
     "bg": "\nRunning full wiki integrity check...",
     "de": "\nRunning full wiki integrity check...",
+    "en": "\nRunning full wiki integrity check...",
     "ru": "\nRunning full wiki integrity check...",
     "zh": "\nRunning full wiki integrity check..."
   },
+  "\nTag → Commit alignment:": {
+    "bg": "\nTag → Commit alignment:",
+    "de": "\nTag → Commit alignment:",
+    "en": "\nTag → Commit alignment:",
+    "ru": "\nTag → Commit alignment:",
+    "zh": "\nTag → Commit alignment:"
+  },
+  "\nUntagged release commits:": {
+    "bg": "\nUntagged release commits:",
+    "de": "\nUntagged release commits:",
+    "en": "\nUntagged release commits:",
+    "ru": "\nUntagged release commits:",
+    "zh": "\nUntagged release commits:"
+  },
   "\nUser-facing changes ({count}):": {
-    "en": "\nUser-facing changes ({count}):",
     "bg": "\nUser-facing changes ({count}):",
     "de": "\nUser-facing changes ({count}):",
+    "en": "\nUser-facing changes ({count}):",
     "ru": "\nUser-facing changes ({count}):",
     "zh": "\nUser-facing changes ({count}):"
   },
   "\nVerification FAILED: {failures} page(s) have empty or mismatched content!": {
-    "en": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
     "bg": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
     "de": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
+    "en": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
     "ru": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
     "zh": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!"
   },
   "\nVerification passed — all wiki pages have correct content.": {
-    "en": "\nVerification passed — all wiki pages have correct content.",
     "bg": "\nVerification passed — all wiki pages have correct content.",
     "de": "\nVerification passed — all wiki pages have correct content.",
+    "en": "\nVerification passed — all wiki pages have correct content.",
     "ru": "\nVerification passed — all wiki pages have correct content.",
     "zh": "\nVerification passed — all wiki pages have correct content."
   },
   "\nVerifying wiki pages have content...": {
-    "en": "\nVerifying wiki pages have content...",
     "bg": "\nVerifying wiki pages have content...",
     "de": "\nVerifying wiki pages have content...",
+    "en": "\nVerifying wiki pages have content...",
     "ru": "\nVerifying wiki pages have content...",
     "zh": "\nVerifying wiki pages have content..."
   },
   "\nWorkflow-only changes ({count}):": {
-    "en": "\nWorkflow-only changes ({count}):",
     "bg": "\nWorkflow-only changes ({count}):",
     "de": "\nWorkflow-only changes ({count}):",
+    "en": "\nWorkflow-only changes ({count}):",
     "ru": "\nWorkflow-only changes ({count}):",
     "zh": "\nWorkflow-only changes ({count}):"
   },
   "\n[dry-run] Changelog:\n{changelog}": {
-    "en": "\n[dry-run] Changelog:\n{changelog}",
     "bg": "\n[dry-run] Changelog:\n{changelog}",
     "de": "\n[dry-run] Changelog:\n{changelog}",
+    "en": "\n[dry-run] Changelog:\n{changelog}",
     "ru": "\n[dry-run] Changelog:\n{changelog}",
     "zh": "\n[dry-run] Changelog:\n{changelog}"
   },
-  "  - Auto-delete branch after merge: yes": {
-    "en": "  - Auto-delete branch after merge: yes",
-    "bg": "  - Автоматично изтриване на клон след сливане: да",
-    "de": "  - Branch nach Merge automatisch löschen: ja",
-    "ru": "  - Автоудаление ветки после слияния: да",
-    "zh": "  - 合并后自动删除分支: 是"
-  },
-  "  - Block outdated branches: yes": {
-    "en": "  - Block outdated branches: yes",
-    "bg": "  - Блокиране на остарели клонове: да",
-    "de": "  - Veraltete Branches blockieren: ja",
-    "ru": "  - Блокировать устаревшие ветки: да",
-    "zh": "  - 阻止过时分支: 是"
-  },
-  "  - Block rejected reviews: yes": {
-    "en": "  - Block rejected reviews: yes",
-    "bg": "  - Блокиране на отхвърлени рецензии: да",
-    "de": "  - Abgelehnte Reviews blockieren: ja",
-    "ru": "  - Блокировать отклонённые ревью: да",
-    "zh": "  - 阻止被拒绝的审查: 是"
-  },
-  "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)": {
-    "en": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
-    "bg": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
-    "de": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
-    "ru": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
-    "zh": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)"
-  },
-  "  - Dismiss stale approvals: yes": {
-    "en": "  - Dismiss stale approvals: yes",
-    "bg": "  - Анулиране на остарели одобрения: да",
-    "de": "  - Veraltete Genehmigungen ablehnen: ja",
-    "ru": "  - Отклонять устаревшие одобрения: да",
-    "zh": "  - 忽略过时审批: 是"
-  },
-  "  - Required approvals: {count}": {
-    "en": "  - Required approvals: {count}",
-    "bg": "  - Необходими одобрения: {count}",
-    "de": "  - Erforderliche Genehmigungen: {count}",
-    "ru": "  - Требуемые одобрения: {count}",
-    "zh": "  - 必需审批数: {count}"
-  },
-  "  - Required status checks: {checks}": {
-    "en": "  - Required status checks: {checks}",
-    "bg": "  - Необходими проверки на състоянието: {checks}",
-    "de": "  - Erforderliche Status-Checks: {checks}",
-    "ru": "  - Требуемые проверки статуса: {checks}",
-    "zh": "  - 必需状态检查: {checks}"
-  },
-  "  Created: {title}": {
-    "en": "  Created: {title}",
-    "bg": "  Created: {title}",
-    "de": "  Created: {title}",
-    "ru": "  Created: {title}",
-    "zh": "  Created: {title}"
-  },
-  "  FAIL: {title} — content mismatch or empty!": {
-    "en": "  FAIL: {title} — content mismatch or empty!",
-    "bg": "  FAIL: {title} — content mismatch or empty!",
-    "de": "  FAIL: {title} — content mismatch or empty!",
-    "ru": "  FAIL: {title} — content mismatch or empty!",
-    "zh": "  FAIL: {title} — content mismatch or empty!"
-  },
-  "  MISSING: devx {cmd}": {
-    "en": "  MISSING: devx {cmd}",
-    "bg": "  ЛИПСВА: devx {cmd}",
-    "de": "  FEHLT: devx {cmd}",
-    "ru": "  ОТСУТСТВУЕТ: devx {cmd}",
-    "zh": "  缺失: devx {cmd}"
-  },
-  "  MISSING: {module}": {
-    "en": "  MISSING: {module}",
-    "bg": "  MISSING: {module}",
-    "de": "  MISSING: {module}",
-    "ru": "  MISSING: {module}",
-    "zh": "  MISSING: {module}"
-  },
-  "  MISSING: {script}": {
-    "en": "  MISSING: {script}",
-    "bg": "  MISSING: {script}",
-    "de": "  MISSING: {script}",
-    "ru": "  MISSING: {script}",
-    "zh": "  MISSING: {script}"
-  },
-  "  OK: devx {cmd}": {
-    "en": "  OK: devx {cmd}",
-    "bg": "  ОК: devx {cmd}",
-    "de": "  OK: devx {cmd}",
-    "ru": "  ОК: devx {cmd}",
-    "zh": "  正常: devx {cmd}"
-  },
-  "  OK: {module}": {
-    "en": "  OK: {module}",
-    "bg": "  OK: {module}",
-    "de": "  OK: {module}",
-    "ru": "  OK: {module}",
-    "zh": "  OK: {module}"
-  },
-  "  OK: {script}": {
-    "en": "  OK: {script}",
-    "bg": "  OK: {script}",
-    "de": "  OK: {script}",
-    "ru": "  OK: {script}",
-    "zh": "  OK: {script}"
-  },
-  "  OK: {title} ({chars} chars)": {
-    "en": "  OK: {title} ({chars} chars)",
-    "bg": "  OK: {title} ({chars} chars)",
-    "de": "  OK: {title} ({chars} chars)",
-    "ru": "  OK: {title} ({chars} chars)",
-    "zh": "  OK: {title} ({chars} chars)"
-  },
-  "  Updated: {title}": {
-    "en": "  Updated: {title}",
-    "bg": "  Updated: {title}",
-    "de": "  Updated: {title}",
-    "ru": "  Updated: {title}",
-    "zh": "  Updated: {title}"
-  },
-  "API poll warning: {exc}": {
-    "en": "API poll warning: {exc}",
-    "bg": "API poll warning: {exc}",
-    "de": "API poll warning: {exc}",
-    "ru": "API poll warning: {exc}",
-    "zh": "API poll warning: {exc}"
-  },
-  "All molecule tests passed.": {
-    "en": "All molecule tests passed.",
-    "bg": "All molecule tests passed.",
-    "de": "All molecule tests passed.",
-    "ru": "All molecule tests passed.",
-    "zh": "All molecule tests passed."
-  },
-  "Another molecule runner failed. Stopping this runner early.": {
-    "en": "Another molecule runner failed. Stopping this runner early.",
-    "bg": "Another molecule runner failed. Stopping this runner early.",
-    "de": "Another molecule runner failed. Stopping this runner early.",
-    "ru": "Another molecule runner failed. Stopping this runner early.",
-    "zh": "Another molecule runner failed. Stopping this runner early."
-  },
-  "Bumping version: {current} -> v{new_version}": {
-    "en": "Bumping version: {current} -> v{new_version}",
-    "bg": "Bumping version: {current} -> v{new_version}",
-    "de": "Bumping version: {current} -> v{new_version}",
-    "ru": "Bumping version: {current} -> v{new_version}",
-    "zh": "Bumping version: {current} -> v{new_version}"
-  },
-  "Checking CLI command documentation...": {
-    "en": "Checking CLI command documentation...",
-    "bg": "Checking CLI command documentation...",
-    "de": "Checking CLI command documentation...",
-    "ru": "Checking CLI command documentation...",
-    "zh": "Checking CLI command documentation..."
-  },
-  "Command failed ({cmd}): {stderr}": {
-    "en": "Command failed ({cmd}): {stderr}",
-    "bg": "Command failed ({cmd}): {stderr}",
-    "de": "Command failed ({cmd}): {stderr}",
-    "ru": "Command failed ({cmd}): {stderr}",
-    "zh": "Command failed ({cmd}): {stderr}"
-  },
-  "Comparing {base}..{head} ({count} files changed)": {
-    "en": "Comparing {base}..{head} ({count} files changed)",
-    "bg": "Comparing {base}..{head} ({count} files changed)",
-    "de": "Comparing {base}..{head} ({count} files changed)",
-    "ru": "Comparing {base}..{head} ({count} files changed)",
-    "zh": "Comparing {base}..{head} ({count} files changed)"
-  },
-  "Configuring branch protection for {branch}...": {
-    "en": "Configuring branch protection for {branch}...",
-    "bg": "Конфигуриране на защита на клона {branch}...",
-    "de": "Konfiguriere Branch-Schutz für {branch}...",
-    "ru": "Настройка защиты ветки {branch}...",
-    "zh": "正在配置 {branch} 的分支保护..."
-  },
-  "Configuring repository settings...": {
-    "en": "Configuring repository settings...",
-    "bg": "Конфигуриране на настройките на хранилището...",
-    "de": "Repository-Einstellungen konfigurieren...",
-    "ru": "Настройка параметров репозитория...",
-    "zh": "正在配置仓库设置..."
-  },
-  "Could not extract conventional commit message from PR commits.": {
-    "en": "Could not extract conventional commit message from PR commits.",
-    "bg": "Could not extract conventional commit message from PR commits.",
-    "de": "Could not extract conventional commit message from PR commits.",
-    "ru": "Could not extract conventional commit message from PR commits.",
-    "zh": "Could not extract conventional commit message from PR commits."
-  },
-  "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.": {
-    "en": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
-    "bg": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
-    "de": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
-    "ru": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
-    "zh": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task."
-  },
-  "Could not find __version__ in {file}": {
-    "en": "Could not find __version__ in {file}",
-    "bg": "Could not find __version__ in {file}",
-    "de": "Could not find __version__ in {file}",
-    "ru": "Could not find __version__ in {file}",
-    "zh": "Could not find __version__ in {file}"
-  },
-  "Could not parse test execution time from output.": {
-    "en": "Could not parse test execution time from output.",
-    "bg": "Could not parse test execution time from output.",
-    "de": "Could not parse test execution time from output.",
-    "ru": "Could not parse test execution time from output.",
-    "zh": "Could not parse test execution time from output."
-  },
-  "Created issue #{issue_id}: {title}": {
-    "en": "Created issue #{issue_id}: {title}",
-    "bg": "Created issue #{issue_id}: {title}",
-    "de": "Created issue #{issue_id}: {title}",
-    "ru": "Created issue #{issue_id}: {title}",
-    "zh": "Created issue #{issue_id}: {title}"
-  },
-  "Created release commit.": {
-    "en": "Created release commit.",
-    "bg": "Created release commit.",
-    "de": "Created release commit.",
-    "ru": "Created release commit.",
-    "zh": "Created release commit."
-  },
-  "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.": {
-    "en": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
-    "bg": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
-    "de": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
-    "ru": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
-    "zh": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently."
-  },
-  "ERROR: REPO_TOKEN is not set.": {
-    "en": "ERROR: REPO_TOKEN is not set.",
-    "bg": "ГРЕШКА: REPO_TOKEN не е зададен.",
-    "de": "FEHLER: REPO_TOKEN ist nicht gesetzt.",
-    "ru": "ОШИБКА: REPO_TOKEN не задан.",
-    "zh": "错误：未设置 REPO_TOKEN。"
-  },
-  "ERROR: VIKUNJA_TOKEN is not set.": {
-    "en": "ERROR: VIKUNJA_TOKEN is not set.",
-    "bg": "ГРЕШКА: VIKUNJA_TOKEN не е зададен.",
-    "de": "FEHLER: VIKUNJA_TOKEN ist nicht gesetzt.",
-    "ru": "ОШИБКА: VIKUNJA_TOKEN не задан.",
-    "zh": "错误：未设置 VIKUNJA_TOKEN。"
-  },
-  "ERROR: Repository name not specified. Use --repo or set DEVX_REPO_NAME.": {
-    "en": "ERROR: Repository name not specified. Use --repo or set DEVX_REPO_NAME.",
-    "bg": "ГРЕШКА: Името на хранилището не е указано. Използвайте --repo или задайте DEVX_REPO_NAME.",
-    "de": "FEHLER: Repository-Name nicht angegeben. Verwenden Sie --repo oder setzen Sie DEVX_REPO_NAME.",
-    "ru": "ОШИБКА: Имя репозитория не указано. Используйте --repo или задайте DEVX_REPO_NAME.",
-    "zh": "错误：未指定仓库名称。请使用 --repo 或设置 DEVX_REPO_NAME。"
-  },
-  "ERROR: mapping.json not found at {path}": {
-    "en": "ERROR: mapping.json not found at {path}",
-    "bg": "ERROR: mapping.json not found at {path}",
-    "de": "ERROR: mapping.json not found at {path}",
-    "ru": "ERROR: mapping.json not found at {path}",
-    "zh": "ERROR: mapping.json not found at {path}"
-  },
-  "FAILED: {pair} exited with code {code}": {
-    "en": "FAILED: {pair} exited with code {code}",
-    "bg": "FAILED: {pair} exited with code {code}",
-    "de": "FAILED: {pair} exited with code {code}",
-    "ru": "FAILED: {pair} exited with code {code}",
-    "zh": "FAILED: {pair} exited with code {code}"
-  },
-  "Failed to create issue via tea: {error}": {
-    "en": "Failed to create issue via tea: {error}",
-    "bg": "Failed to create issue via tea: {error}",
-    "de": "Failed to create issue via tea: {error}",
-    "ru": "Failed to create issue via tea: {error}",
-    "zh": "Failed to create issue via tea: {error}"
-  },
-  "Found {count} existing wiki pages.": {
-    "en": "Found {count} existing wiki pages.",
-    "bg": "Found {count} existing wiki pages.",
-    "de": "Found {count} existing wiki pages.",
-    "ru": "Found {count} existing wiki pages.",
-    "zh": "Found {count} existing wiki pages."
-  },
-  "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.": {
-    "en": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
-    "bg": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
-    "de": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
-    "ru": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
-    "zh": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation."
-  },
-  "HTTP error: {status} — {message}": {
-    "en": "HTTP error: {status} — {message}",
-    "bg": "HTTP грешка: {status} — {message}",
-    "de": "HTTP-Fehler: {status} — {message}",
-    "ru": "Ошибка HTTP: {status} — {message}",
-    "zh": "HTTP 错误: {status} — {message}"
-  },
-  "HTTP {status} Forbidden — your token lacks admin rights.\nMake sure the token belongs to a repo owner or organisation admin.\nAlternatively, configure branch protection manually in Settings → Branches.": {
-    "en": "HTTP {status} Forbidden — your token lacks admin rights.\nMake sure the token belongs to a repo owner or organisation admin.\nAlternatively, configure branch protection manually in Settings → Branches.",
-    "bg": "HTTP {status} Забранено — вашият токен няма администраторски права.\nУверете се, че токенът принадлежи на собственик на хранилище или администратор на организация.\nАлтернативно, конфигурирайте защитата на клона ръчно в Настройки → Клонове.",
-    "de": "HTTP {status} Verboten — Ihr Token hat keine Admin-Rechte.\nStellen Sie sicher, dass das Token einem Repository-Besitzer oder Organisations-Admin gehört.\nAlternativ können Sie den Branch-Schutz manuell unter Einstellungen → Branches konfigurieren.",
-    "ru": "HTTP {status} Запрещено — у вашего токена нет прав администратора.\nУбедитесь, что токен принадлежит владельцу репозитория или администратору организации.\nЛибо настройте защиту ветки вручную в разделе Настройки → Ветки.",
-    "zh": "HTTP {status} 禁止访问 — 您的令牌缺少管理员权限。\n请确保令牌属于仓库所有者或组织管理员。\n或者，您可以在 设置 → 分支 中手动配置分支保护。"
-  },
-  "Head branch is behind master. Pulling and rebasing...": {
-    "en": "Head branch is behind master. Pulling and rebasing...",
-    "bg": "Head branch is behind master. Pulling and rebasing...",
-    "de": "Head branch is behind master. Pulling and rebasing...",
-    "ru": "Head branch is behind master. Pulling and rebasing...",
-    "zh": "Head branch is behind master. Pulling and rebasing..."
-  },
-  "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}": {
-    "en": "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}",
-    "bg": "Инфраструктурен commit (без идентификатор на задача DEVX-N), пропускаме обновяването на Vikunja: {msg}",
-    "de": "Infrastruktur-Commit (keine DEVX-N Task-ID), Vikunja-Update wird übersprungen: {msg}",
-    "ru": "Инфраструктурный коммит (без ID задачи DEVX-N), пропуск обновления Vikunja: {msg}",
-    "zh": "基础设施提交（无 DEVX-N 任务 ID），跳过 Vikunja 更新: {msg}"
-  },
-  "Lint failed — refusing to release. Fix lint errors first.\n{stderr}": {
-    "en": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
-    "bg": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
-    "de": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
-    "ru": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
-    "zh": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}"
-  },
-  "Lint passed.": {
-    "en": "Lint passed.",
-    "bg": "Lint passed.",
-    "de": "Lint passed.",
-    "ru": "Lint passed.",
-    "zh": "Lint passed."
-  },
-  "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.": {
-    "en": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
-    "bg": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
-    "de": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
-    "ru": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
-    "zh": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually."
-  },
-  "Merge failed with HTTP {status}: {message}\nPlease check the PR is ready and you have merge rights.": {
-    "en": "Merge failed with HTTP {status}: {message}\nPlease check the PR is ready and you have merge rights.",
-    "bg": "Сливането неуспешно с HTTP {status}: {message}\nПроверете дали PR е готов и имате права за сливане.",
-    "de": "Merge fehlgeschlagen mit HTTP {status}: {message}\nBitte prüfen Sie, ob der PR bereit ist und Sie Merge-Rechte haben.",
-    "ru": "Слияние не удалось: HTTP {status}: {message}\nПроверьте, что PR готов и у вас есть права на слияние.",
-    "zh": "合并失败: HTTP {status}: {message}\n请检查 PR 是否准备就绪且您具有合并权限。"
-  },
-  "Module {mod} has no main() function": {
-    "en": "Module {mod} has no main() function",
-    "bg": "Модул {mod} няма функция main()",
-    "de": "Modul {mod} hat keine main()-Funktion",
-    "ru": "Модуль {mod} не имеет функции main()",
-    "zh": "模块 {mod} 没有 main() 函数"
-  },
-  "Molecule directory not found: {path}": {
-    "en": "Molecule directory not found: {path}",
-    "bg": "Директорията на molecule не е намерена: {path}",
-    "de": "Molecule-Verzeichnis nicht gefunden: {path}",
-    "ru": "Директория molecule не найдена: {path}",
-    "zh": "未找到 molecule 目录: {path}"
-  },
-  "Nice! Gitea release {tag} created.": {
-    "en": "Nice! Gitea release {tag} created.",
-    "bg": "Отлично! Gitea release {tag} е създаден.",
-    "de": "Prima! Gitea-Release {tag} erstellt.",
-    "ru": "Отлично! Gitea release {tag} создан.",
-    "zh": "不错！Gitea release {tag} 已创建。"
-  },
-  "Nice! PR #{pr_number} squash-merged with title: {merge_title}": {
-    "en": "Nice! PR #{pr_number} squash-merged with title: {merge_title}",
-    "bg": "Отлично! PR #{pr_number} е squash-merge-нат със заглавие: {merge_title}",
-    "de": "Prima! PR #{pr_number} wurde mit Titel {merge_title} squash-gemergt.",
-    "ru": "Отлично! PR #{pr_number} squash-merge с заголовком: {merge_title}",
-    "zh": "不错！PR #{pr_number} 已 squash 合并，标题: {merge_title}"
-  },
-  "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.": {
-    "en": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
-    "bg": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
-    "de": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
-    "ru": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
-    "zh": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered."
-  },
-  "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.": {
-    "en": "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.",
-    "bg": "Отлично! Задача Vikunja {task_id} (ID {vikunja_id}) е обновена и маркирана като готова.",
-    "de": "Prima! Vikunja-Aufgabe {task_id} (ID {vikunja_id}) aktualisiert und als erledigt markiert.",
-    "ru": "Отлично! Задача Vikunja {task_id} (ID {vikunja_id}) обновлена и отмечена как выполненная.",
-    "zh": "不错！Vikunja 任务 {task_id} (ID {vikunja_id}) 已更新并标记为完成。"
-  },
-  "No changes between {base} and {head}.": {
-    "en": "No changes between {base} and {head}.",
-    "bg": "No changes between {base} and {head}.",
-    "de": "No changes between {base} and {head}.",
-    "ru": "No changes between {base} and {head}.",
-    "zh": "No changes between {base} and {head}."
-  },
-  "No staged changes — version and changelog already up to date.": {
-    "en": "No staged changes — version and changelog already up to date.",
-    "bg": "No staged changes — version and changelog already up to date.",
-    "de": "No staged changes — version and changelog already up to date.",
-    "ru": "No staged changes — version and changelog already up to date.",
-    "zh": "No staged changes — version and changelog already up to date."
-  },
-  "No tags found — treating all changes as user-facing.": {
-    "en": "No tags found — treating all changes as user-facing.",
-    "bg": "No tags found — treating all changes as user-facing.",
-    "de": "No tags found — treating all changes as user-facing.",
-    "ru": "No tags found — treating all changes as user-facing.",
-    "zh": "No tags found — treating all changes as user-facing."
-  },
-  "No unreleased changes found. Nothing to release.": {
-    "en": "No unreleased changes found. Nothing to release.",
-    "bg": "No unreleased changes found. Nothing to release.",
-    "de": "No unreleased changes found. Nothing to release.",
-    "ru": "No unreleased changes found. Nothing to release.",
-    "zh": "No unreleased changes found. Nothing to release."
-  },
-  "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.": {
-    "en": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
-    "bg": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
-    "de": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
-    "ru": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
-    "zh": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release."
-  },
-  "Note: Self-approval not allowed. Posting COMMENT instead.": {
-    "en": "Note: Self-approval not allowed. Posting COMMENT instead.",
-    "bg": "Note: Self-approval not allowed. Posting COMMENT instead.",
-    "de": "Note: Self-approval not allowed. Posting COMMENT instead.",
-    "ru": "Note: Self-approval not allowed. Posting COMMENT instead.",
-    "zh": "Note: Self-approval not allowed. Posting COMMENT instead."
-  },
-  "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE": {
-    "en": "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "bg": "Опа! Съобщението за commit трябва да следва конвенционален формат.\n  Очаква се: <type>: <description>\n  Получено: {subject}\n  Разрешени типове: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "de": "Ups! Commit-Nachricht muss dem konventionellen Commit-Format folgen.\n  Erwartet: <type>: <description>\n  Erhalten: {subject}\n  Erlaubte Typen: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "ru": "Ой! Сообщение коммита должно соответствовать формату conventional commit.\n  Ожидается: <type>: <description>\n  Получено: {subject}\n  Допустимые типы: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "zh": "哎呀！提交消息必须遵循 conventional commit 格式。\n  预期格式: <type>: <description>\n  实际: {subject}\n  允许的类型: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE"
-  },
-  "Oops! Do not include task ID (DEVX-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.": {
-    "en": "Oops! Do not include task ID (DEVX-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.",
-    "bg": "Опа! Не включвайте идентификатор на задача (DEVX-N) в commit-и от feature клонове.\n  Идентификаторът ще бъде добавен автоматично при сливане чрез CI.",
-    "de": "Ups! Keine Task-ID (DEVX-N) in Feature-Branch-Commits einfügen.\n  Die Task-ID wird beim Merge automatisch über CI hinzugefügt.",
-    "ru": "Ой! Не включайте ID задачи (DEVX-N) в коммиты feature-веток.\n  ID задачи будет добавлен автоматически при слиянии через CI.",
-    "zh": "哎呀！不要在 feature 分支的提交中包含任务 ID (DEVX-N)。\n  任务 ID 将在通过 CI 合并时自动添加。"
-  },
-  "Oops! Gitea PyPI registry publish failed:\n{stderr}": {
-    "en": "Oops! Gitea PyPI registry publish failed:\n{stderr}",
-    "bg": "Опа! Публикуването в Gitea PyPI registry неуспешно:\n{stderr}",
-    "de": "Ups! Veröffentlichung in der Gitea PyPI-Registry fehlgeschlagen:\n{stderr}",
-    "ru": "Ой! Публикация в Gitea PyPI registry не удалась:\n{stderr}",
-    "zh": "哎呀！Gitea PyPI registry 发布失败：\n{stderr}"
-  },
-  "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: DEVX-N: <type>: <description>\n  Got:      {subject}": {
-    "en": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: DEVX-N: <type>: <description>\n  Got:      {subject}",
-    "bg": "Опа! Commit-ът в клона master трябва да следва конвенционален формат след идентификатора.\n  Очаква се: DEVX-N: <type>: <description>\n  Получено: {subject}",
-    "de": "Ups! Master-Branch-Commit muss nach der Task-ID dem konventionellen Format folgen.\n  Erwartet: DEVX-N: <type>: <description>\n  Erhalten: {subject}",
-    "ru": "Ой! Коммит в ветку master после ID задачи должен соответствовать conventional формату.\n  Ожидается: DEVX-N: <type>: <description>\n  Получено: {subject}",
-    "zh": "哎呀！master 分支提交在任务 ID 后必须遵循 conventional commit 格式。\n  预期格式: DEVX-N: <type>: <description>\n  实际: {subject}"
-  },
-  "Oops! Master branch commits must start with a task ID.\n  Expected: DEVX-N: <conventional commit message>\n  Got:      {subject}": {
-    "en": "Oops! Master branch commits must start with a task ID.\n  Expected: DEVX-N: <conventional commit message>\n  Got:      {subject}",
-    "bg": "Опа! Commit-ите в клона master трябва да започват с идентификатор на задача.\n  Очаква се: DEVX-N: <conventional commit message>\n  Получено: {subject}",
-    "de": "Ups! Master-Branch-Commits müssen mit einer Task-ID beginnen.\n  Erwartet: DEVX-N: <conventional commit message>\n  Erhalten: {subject}",
-    "ru": "Ой! Коммиты в ветку master должны начинаться с ID задачи.\n  Ожидается: DEVX-N: <conventional commit message>\n  Получено: {subject}",
-    "zh": "哎呀！master 分支的提交必须以任务 ID 开头。\n  预期格式: DEVX-N: <conventional commit message>\n  实际: {subject}"
-  },
-  "Oops! No task ID found in .taskid file or branch name '{branch}'.": {
-    "en": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
-    "bg": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
-    "de": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
-    "ru": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
-    "zh": "Oops! No task ID found in .taskid file or branch name '{branch}'."
-  },
-  "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}": {
-    "en": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
-    "bg": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
-    "de": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
-    "ru": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
-    "zh": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}"
-  },
-  "Oops! Package build failed:\n{stderr}": {
-    "en": "Oops! Package build failed:\n{stderr}",
-    "bg": "Опа! Сборката на пакета неуспешна:\n{stderr}",
-    "de": "Ups! Paket-Build fehlgeschlagen:\n{stderr}",
-    "ru": "Ой! Сборка пакета не удалась:\n{stderr}",
-    "zh": "哎呀！包构建失败：\n{stderr}"
-  },
-  "Oops! PyPI publish failed:\n{stderr}": {
-    "en": "Oops! PyPI publish failed:\n{stderr}",
-    "bg": "Опа! Публикуването в PyPI неуспешно:\n{stderr}",
-    "de": "Ups! PyPI-Veröffentlichung fehlgeschlagen:\n{stderr}",
-    "ru": "Ой! Публикация в PyPI не удалась:\n{stderr}",
-    "zh": "哎呀！PyPI 发布失败：\n{stderr}"
-  },
-  "PASSED: {pair}": {
-    "en": "PASSED: {pair}",
-    "bg": "PASSED: {pair}",
-    "de": "PASSED: {pair}",
-    "ru": "PASSED: {pair}",
-    "zh": "PASSED: {pair}"
-  },
-  "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}": {
-    "en": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
-    "bg": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
-    "de": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
-    "ru": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
-    "zh": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}"
-  },
-  "PYPI_TOKEN not set and no registry URL configured — skipping PyPI publish. No worries, we'll just create the Gitea release.": {
-    "en": "PYPI_TOKEN not set and no registry URL configured — skipping PyPI publish. No worries, we'll just create the Gitea release.",
-    "bg": "PYPI_TOKEN не е зададен и няма конфигуриран URL на registry — пропускаме публикуването в PyPI. Без притеснения, просто ще създадем Gitea release.",
-    "de": "PYPI_TOKEN nicht gesetzt und keine Registry-URL konfiguriert — PyPI-Veröffentlichung wird übersprungen. Keine Sorge, wir erstellen einfach das Gitea-Release.",
-    "ru": "PYPI_TOKEN не задан и URL registry не настроен — пропускаем публикацию в PyPI. Не беспокойтесь, мы просто создадим Gitea release.",
-    "zh": "未设置 PYPI_TOKEN 且未配置 registry URL — 跳过 PyPI 发布。别担心，我们直接创建 Gitea release。"
-  },
-  "Published to Gitea PyPI registry.": {
-    "en": "Published to Gitea PyPI registry.",
-    "bg": "Публикувано в Gitea PyPI registry.",
-    "de": "In der Gitea PyPI-Registry veröffentlicht.",
-    "ru": "Опубликовано в Gitea PyPI registry.",
-    "zh": "已发布到 Gitea PyPI registry。"
-  },
-  "Published to PyPI.": {
-    "en": "Published to PyPI.",
-    "bg": "Публикувано в PyPI.",
-    "de": "In PyPI veröffentlicht.",
-    "ru": "Опубликовано в PyPI.",
-    "zh": "已发布到 PyPI。"
-  },
-  "Pushed release commit to master.": {
-    "en": "Pushed release commit to master.",
-    "bg": "Pushed release commit to master.",
-    "de": "Pushed release commit to master.",
-    "ru": "Pushed release commit to master.",
-    "zh": "Pushed release commit to master."
-  },
-  "Rebased and pushed. Retrying merge...": {
-    "en": "Rebased and pushed. Retrying merge...",
-    "bg": "Rebased and pushed. Retrying merge...",
-    "de": "Rebased and pushed. Retrying merge...",
-    "ru": "Rebased and pushed. Retrying merge...",
-    "zh": "Rebased and pushed. Retrying merge..."
-  },
-  "Release creation failed: {error}": {
-    "en": "Release creation failed: {error}",
-    "bg": "Release creation failed: {error}",
-    "de": "Release creation failed: {error}",
-    "ru": "Release creation failed: {error}",
-    "zh": "Release creation failed: {error}"
-  },
-  "Release must be run on master, currently on '{branch}'.": {
-    "en": "Release must be run on master, currently on '{branch}'.",
-    "bg": "Release must be run on master, currently on '{branch}'.",
-    "de": "Release must be run on master, currently on '{branch}'.",
-    "ru": "Release must be run on master, currently on '{branch}'.",
-    "zh": "Release must be run on master, currently on '{branch}'."
-  },
-  "Repository configuration complete.": {
-    "en": "Repository configuration complete.",
-    "bg": "Конфигурирането на хранилището е завършено.",
-    "de": "Repository-Konfiguration abgeschlossen.",
-    "ru": "Конфигурация репозитория завершена.",
-    "zh": "仓库配置完成。"
-  },
-  "Runner index {index} out of range (0..{max})": {
-    "en": "Runner index {index} out of range (0..{max})",
-    "bg": "Индексът на runner {index} е извън диапазона (0..{max})",
-    "de": "Runner-Index {index} außerhalb des Bereichs (0..{max})",
-    "ru": "Индекс runner {index} вне диапазона (0..{max})",
-    "zh": "Runner 索引 {index} 超出范围 (0..{max})"
-  },
-  "Running lint checks...": {
-    "en": "Running lint checks...",
-    "bg": "Running lint checks...",
-    "de": "Running lint checks...",
-    "ru": "Running lint checks...",
-    "zh": "Running lint checks..."
-  },
-  "Running tests...": {
-    "en": "Running tests...",
-    "bg": "Running tests...",
-    "de": "Running tests...",
-    "ru": "Running tests...",
-    "zh": "Running tests..."
-  },
-  "Running: {scenario} on {platform}": {
-    "en": "Running: {scenario} on {platform}",
-    "bg": "Running: {scenario} on {platform}",
-    "de": "Running: {scenario} on {platform}",
-    "ru": "Running: {scenario} on {platform}",
-    "zh": "Running: {scenario} on {platform}"
-  },
-  "Skipping commit push — no staged changes.": {
-    "en": "Skipping commit push — no staged changes.",
-    "bg": "Skipping commit push — no staged changes.",
-    "de": "Skipping commit push — no staged changes.",
-    "ru": "Skipping commit push — no staged changes.",
-    "zh": "Skipping commit push — no staged changes."
-  },
-  "Syncing {count} documentation pages to wiki...": {
-    "en": "Syncing {count} documentation pages to wiki...",
-    "bg": "Syncing {count} documentation pages to wiki...",
-    "de": "Syncing {count} documentation pages to wiki...",
-    "ru": "Syncing {count} documentation pages to wiki...",
-    "zh": "Syncing {count} documentation pages to wiki..."
-  },
-  "Tag v{version} already existed. Publish workflow should already have been triggered.": {
-    "en": "Tag v{version} already existed. Publish workflow should already have been triggered.",
-    "bg": "Tag v{version} already existed. Publish workflow should already have been triggered.",
-    "de": "Tag v{version} already existed. Publish workflow should already have been triggered.",
-    "ru": "Tag v{version} already existed. Publish workflow should already have been triggered.",
-    "zh": "Tag v{version} already existed. Publish workflow should already have been triggered."
-  },
-  "Tag {tag} already exists, skipping creation.": {
-    "en": "Tag {tag} already exists, skipping creation.",
-    "bg": "Tag {tag} already exists, skipping creation.",
-    "de": "Tag {tag} already exists, skipping creation.",
-    "ru": "Tag {tag} already exists, skipping creation.",
-    "zh": "Tag {tag} already exists, skipping creation."
-  },
-  "Task ID: {task_id}": {
-    "en": "Task ID: {task_id}",
-    "bg": "Task ID: {task_id}",
-    "de": "Task ID: {task_id}",
-    "ru": "Task ID: {task_id}",
-    "zh": "Task ID: {task_id}"
-  },
-  "Tests failed — refusing to release. Fix test failures first.\n{stderr}": {
-    "en": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
-    "bg": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
-    "de": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
-    "ru": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
-    "zh": "Tests failed — refusing to release. Fix test failures first.\n{stderr}"
-  },
-  "Tests passed.": {
-    "en": "Tests passed.",
-    "bg": "Tests passed.",
-    "de": "Tests passed.",
-    "ru": "Tests passed.",
-    "zh": "Tests passed."
-  },
-  "Unit tests passed in {duration:.2f}s (under {max}s limit).": {
-    "en": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
-    "bg": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
-    "de": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
-    "ru": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
-    "zh": "Unit tests passed in {duration:.2f}s (under {max}s limit)."
-  },
-  "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.": {
-    "en": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
-    "bg": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
-    "de": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
-    "ru": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
-    "zh": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures."
-  },
-  "Updated version in {init}": {
-    "en": "Updated version in {init}",
-    "bg": "Updated version in {init}",
-    "de": "Updated version in {init}",
-    "ru": "Updated version in {init}",
-    "zh": "Updated version in {init}"
-  },
-  "Updated {changelog_file}": {
-    "en": "Updated {changelog_file}",
-    "bg": "Updated {changelog_file}",
-    "de": "Updated {changelog_file}",
-    "ru": "Updated {changelog_file}",
-    "zh": "Updated {changelog_file}"
-  },
-  "WARNING: --skip-tests passed — skipping test verification.": {
-    "en": "WARNING: --skip-tests passed — skipping test verification.",
-    "bg": "WARNING: --skip-tests passed — skipping test verification.",
-    "de": "WARNING: --skip-tests passed — skipping test verification.",
-    "ru": "WARNING: --skip-tests passed — skipping test verification.",
-    "zh": "WARNING: --skip-tests passed — skipping test verification."
-  },
-  "Wiki integrity check failed — {count} issue(s)": {
-    "en": "Wiki integrity check failed — {count} issue(s)",
-    "bg": "Wiki integrity check failed — {count} issue(s)",
-    "de": "Wiki integrity check failed — {count} issue(s)",
-    "ru": "Wiki integrity check failed — {count} issue(s)",
-    "zh": "Wiki integrity check failed — {count} issue(s)"
-  },
-  "Wiki verification failed — {failures} page(s) empty or mismatched": {
-    "en": "Wiki verification failed — {failures} page(s) empty or mismatched",
-    "bg": "Wiki verification failed — {failures} page(s) empty or mismatched",
-    "de": "Wiki verification failed — {failures} page(s) empty or mismatched",
-    "ru": "Wiki verification failed — {failures} page(s) empty or mismatched",
-    "zh": "Wiki verification failed — {failures} page(s) empty or mismatched"
-  },
-  "[dry-run] Would commit: release: v{version}": {
-    "en": "[dry-run] Would commit: release: v{version}",
-    "bg": "[dry-run] Would commit: release: v{version}",
-    "de": "[dry-run] Would commit: release: v{version}",
-    "ru": "[dry-run] Would commit: release: v{version}",
-    "zh": "[dry-run] Would commit: release: v{version}"
-  },
-  "[dry-run] Would create tag: v{version}": {
-    "en": "[dry-run] Would create tag: v{version}",
-    "bg": "[dry-run] Would create tag: v{version}",
-    "de": "[dry-run] Would create tag: v{version}",
-    "ru": "[dry-run] Would create tag: v{version}",
-    "zh": "[dry-run] Would create tag: v{version}"
-  },
-  "[dry-run] Would create tag: {tag}": {
-    "en": "[dry-run] Would create tag: {tag}",
-    "bg": "[dry-run] Would create tag: {tag}",
-    "de": "[dry-run] Would create tag: {tag}",
-    "ru": "[dry-run] Would create tag: {tag}",
-    "zh": "[dry-run] Would create tag: {tag}"
-  },
-  "[dry-run] Would push commit to master": {
-    "en": "[dry-run] Would push commit to master",
-    "bg": "[dry-run] Would push commit to master",
-    "de": "[dry-run] Would push commit to master",
-    "ru": "[dry-run] Would push commit to master",
-    "zh": "[dry-run] Would push commit to master"
-  },
-  "[dry-run] Would sync page: {title} ({chars} chars)": {
-    "en": "[dry-run] Would sync page: {title} ({chars} chars)",
-    "bg": "[dry-run] Would sync page: {title} ({chars} chars)",
-    "de": "[dry-run] Would sync page: {title} ({chars} chars)",
-    "ru": "[dry-run] Would sync page: {title} ({chars} chars)",
-    "zh": "[dry-run] Would sync page: {title} ({chars} chars)"
-  },
-  "[dry-run] Would update {changelog_file}": {
-    "en": "[dry-run] Would update {changelog_file}",
-    "bg": "[dry-run] Would update {changelog_file}",
-    "de": "[dry-run] Would update {changelog_file}",
-    "ru": "[dry-run] Would update {changelog_file}",
-    "zh": "[dry-run] Would update {changelog_file}"
-  },
-  "[dry-run] Would update {init}": {
-    "en": "[dry-run] Would update {init}",
-    "bg": "[dry-run] Would update {init}",
-    "de": "[dry-run] Would update {init}",
-    "ru": "[dry-run] Would update {init}",
-    "zh": "[dry-run] Would update {init}"
-  },
-  "active": {
-    "en": "active",
-    "bg": "активен",
-    "de": "aktiv",
-    "ru": "активен",
-    "zh": "活跃"
-  },
-  "completed": {
-    "en": "completed",
-    "bg": "завършен",
-    "de": "abgeschlossen",
-    "ru": "завершён",
-    "zh": "已完成"
-  },
-  "failed": {
-    "en": "failed",
-    "bg": "неуспешен",
-    "de": "fehlgeschlagen",
-    "ru": "неудачный",
-    "zh": "失败"
-  },
-  "git command failed ({cmd}): {stderr}": {
-    "en": "git command failed ({cmd}): {stderr}",
-    "bg": "git command failed ({cmd}): {stderr}",
-    "de": "git command failed ({cmd}): {stderr}",
-    "ru": "git command failed ({cmd}): {stderr}",
-    "zh": "git command failed ({cmd}): {stderr}"
-  },
-  "git-cliff returned empty version.": {
-    "en": "git-cliff returned empty version.",
-    "bg": "git-cliff returned empty version.",
-    "de": "git-cliff returned empty version.",
-    "ru": "git-cliff returned empty version.",
-    "zh": "git-cliff returned empty version."
-  },
-  "inactive": {
-    "en": "inactive",
-    "bg": "неактивен",
-    "de": "inaktiv",
-    "ru": "неактивен",
-    "zh": "未激活"
-  },
-  "in_progress": {
-    "en": "in progress",
-    "bg": "в процес",
-    "de": "in Bearbeitung",
-    "ru": "в процессе",
-    "zh": "进行中"
-  },
-  "pending": {
-    "en": "pending",
-    "bg": "в очакване",
-    "de": "ausstehend",
-    "ru": "ожидает",
-    "zh": "待处理"
-  },
-  "unknown": {
-    "en": "unknown",
-    "bg": "неизвестен",
-    "de": "unbekannt",
-    "ru": "неизвестно",
-    "zh": "未知"
-  },
   "\n{label} files changed ({count}):": {
-    "en": "\n{label} files changed ({count}):",
     "bg": "\n{label} files changed ({count}):",
     "de": "\n{label} files changed ({count}):",
+    "en": "\n{label} files changed ({count}):",
     "ru": "\n{label} files changed ({count}):",
     "zh": "\n{label} files changed ({count}):"
   },
   "\n{tag} files ({count}):": {
-    "en": "\n{tag} files ({count}):",
     "bg": "\n{tag} files ({count}):",
     "de": "\n{tag} files ({count}):",
+    "en": "\n{tag} files ({count}):",
     "ru": "\n{tag} files ({count}):",
     "zh": "\n{tag} files ({count}):"
   },
-  "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}": {
-    "en": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
-    "bg": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
-    "de": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
-    "ru": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
-    "zh": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}"
+  "  - Auto-delete branch after merge: yes": {
+    "bg": "  - Автоматично изтриване на клон след сливане: да",
+    "de": "  - Branch nach Merge automatisch löschen: ja",
+    "en": "  - Auto-delete branch after merge: yes",
+    "ru": "  - Автоудаление ветки после слияния: да",
+    "zh": "  - 合并后自动删除分支: 是"
   },
-  "Unknown check category '{check}'. Available: all, user-facing{tags}": {
-    "en": "Unknown check category '{check}'. Available: all, user-facing{tags}",
-    "bg": "Unknown check category '{check}'. Available: all, user-facing{tags}",
-    "de": "Unknown check category '{check}'. Available: all, user-facing{tags}",
-    "ru": "Unknown check category '{check}'. Available: all, user-facing{tags}",
-    "zh": "Unknown check category '{check}'. Available: all, user-facing{tags}"
+  "  - Block outdated branches: yes": {
+    "bg": "  - Блокиране на остарели клонове: да",
+    "de": "  - Veraltete Branches blockieren: ja",
+    "en": "  - Block outdated branches: yes",
+    "ru": "  - Блокировать устаревшие ветки: да",
+    "zh": "  - 阻止过时分支: 是"
+  },
+  "  - Block rejected reviews: yes": {
+    "bg": "  - Блокиране на отхвърлени рецензии: да",
+    "de": "  - Abgelehnte Reviews blockieren: ja",
+    "en": "  - Block rejected reviews: yes",
+    "ru": "  - Блокировать отклонённые ревью: да",
+    "zh": "  - 阻止被拒绝的审查: 是"
+  },
+  "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)": {
+    "bg": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "de": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "en": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "ru": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "zh": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)"
+  },
+  "  - Dismiss stale approvals: yes": {
+    "bg": "  - Анулиране на остарели одобрения: да",
+    "de": "  - Veraltete Genehmigungen ablehnen: ja",
+    "en": "  - Dismiss stale approvals: yes",
+    "ru": "  - Отклонять устаревшие одобрения: да",
+    "zh": "  - 忽略过时审批: 是"
+  },
+  "  - Required approvals: {count}": {
+    "bg": "  - Необходими одобрения: {count}",
+    "de": "  - Erforderliche Genehmigungen: {count}",
+    "en": "  - Required approvals: {count}",
+    "ru": "  - Требуемые одобрения: {count}",
+    "zh": "  - 必需审批数: {count}"
+  },
+  "  - Required status checks: {checks}": {
+    "bg": "  - Необходими проверки на състоянието: {checks}",
+    "de": "  - Erforderliche Status-Checks: {checks}",
+    "en": "  - Required status checks: {checks}",
+    "ru": "  - Требуемые проверки статуса: {checks}",
+    "zh": "  - 必需状态检查: {checks}"
+  },
+  "  Created: {title}": {
+    "bg": "  Created: {title}",
+    "de": "  Created: {title}",
+    "en": "  Created: {title}",
+    "ru": "  Created: {title}",
+    "zh": "  Created: {title}"
+  },
+  "  FAIL: {title} — content mismatch or empty!": {
+    "bg": "  FAIL: {title} — content mismatch or empty!",
+    "de": "  FAIL: {title} — content mismatch or empty!",
+    "en": "  FAIL: {title} — content mismatch or empty!",
+    "ru": "  FAIL: {title} — content mismatch or empty!",
+    "zh": "  FAIL: {title} — content mismatch or empty!"
+  },
+  "  MISSING: devx {cmd}": {
+    "bg": "  ЛИПСВА: devx {cmd}",
+    "de": "  FEHLT: devx {cmd}",
+    "en": "  MISSING: devx {cmd}",
+    "ru": "  ОТСУТСТВУЕТ: devx {cmd}",
+    "zh": "  缺失: devx {cmd}"
+  },
+  "  MISSING: {module}": {
+    "bg": "  MISSING: {module}",
+    "de": "  MISSING: {module}",
+    "en": "  MISSING: {module}",
+    "ru": "  MISSING: {module}",
+    "zh": "  MISSING: {module}"
+  },
+  "  MISSING: {script}": {
+    "bg": "  MISSING: {script}",
+    "de": "  MISSING: {script}",
+    "en": "  MISSING: {script}",
+    "ru": "  MISSING: {script}",
+    "zh": "  MISSING: {script}"
+  },
+  "  OK: devx {cmd}": {
+    "bg": "  ОК: devx {cmd}",
+    "de": "  OK: devx {cmd}",
+    "en": "  OK: devx {cmd}",
+    "ru": "  ОК: devx {cmd}",
+    "zh": "  正常: devx {cmd}"
+  },
+  "  OK: {module}": {
+    "bg": "  OK: {module}",
+    "de": "  OK: {module}",
+    "en": "  OK: {module}",
+    "ru": "  OK: {module}",
+    "zh": "  OK: {module}"
+  },
+  "  OK: {script}": {
+    "bg": "  OK: {script}",
+    "de": "  OK: {script}",
+    "en": "  OK: {script}",
+    "ru": "  OK: {script}",
+    "zh": "  OK: {script}"
+  },
+  "  OK: {title} ({chars} chars)": {
+    "bg": "  OK: {title} ({chars} chars)",
+    "de": "  OK: {title} ({chars} chars)",
+    "en": "  OK: {title} ({chars} chars)",
+    "ru": "  OK: {title} ({chars} chars)",
+    "zh": "  OK: {title} ({chars} chars)"
+  },
+  "  Updated: {title}": {
+    "bg": "  Updated: {title}",
+    "de": "  Updated: {title}",
+    "en": "  Updated: {title}",
+    "ru": "  Updated: {title}",
+    "zh": "  Updated: {title}"
+  },
+  "--skip-build: skipping package build and PyPI publish.": {
+    "bg": "--skip-build: skipping package build and PyPI publish.",
+    "de": "--skip-build: skipping package build and PyPI publish.",
+    "en": "--skip-build: skipping package build and PyPI publish.",
+    "ru": "--skip-build: skipping package build and PyPI publish.",
+    "zh": "--skip-build: skipping package build and PyPI publish."
+  },
+  "=== Release Alignment Verification ===\n": {
+    "bg": "=== Release Alignment Verification ===\n",
+    "de": "=== Release Alignment Verification ===\n",
+    "en": "=== Release Alignment Verification ===\n",
+    "ru": "=== Release Alignment Verification ===\n",
+    "zh": "=== Release Alignment Verification ===\n"
+  },
+  "API poll warning: {exc}": {
+    "bg": "API poll warning: {exc}",
+    "de": "API poll warning: {exc}",
+    "en": "API poll warning: {exc}",
+    "ru": "API poll warning: {exc}",
+    "zh": "API poll warning: {exc}"
+  },
+  "All molecule tests passed.": {
+    "bg": "All molecule tests passed.",
+    "de": "All molecule tests passed.",
+    "en": "All molecule tests passed.",
+    "ru": "All molecule tests passed.",
+    "zh": "All molecule tests passed."
+  },
+  "Another molecule runner failed. Stopping this runner early.": {
+    "bg": "Another molecule runner failed. Stopping this runner early.",
+    "de": "Another molecule runner failed. Stopping this runner early.",
+    "en": "Another molecule runner failed. Stopping this runner early.",
+    "ru": "Another molecule runner failed. Stopping this runner early.",
+    "zh": "Another molecule runner failed. Stopping this runner early."
+  },
+  "Bumping version: {current} -> v{new_version}": {
+    "bg": "Bumping version: {current} -> v{new_version}",
+    "de": "Bumping version: {current} -> v{new_version}",
+    "en": "Bumping version: {current} -> v{new_version}",
+    "ru": "Bumping version: {current} -> v{new_version}",
+    "zh": "Bumping version: {current} -> v{new_version}"
+  },
+  "Checking CLI command documentation...": {
+    "bg": "Checking CLI command documentation...",
+    "de": "Checking CLI command documentation...",
+    "en": "Checking CLI command documentation...",
+    "ru": "Checking CLI command documentation...",
+    "zh": "Checking CLI command documentation..."
+  },
+  "Command failed ({cmd}): {stderr}": {
+    "bg": "Command failed ({cmd}): {stderr}",
+    "de": "Command failed ({cmd}): {stderr}",
+    "en": "Command failed ({cmd}): {stderr}",
+    "ru": "Command failed ({cmd}): {stderr}",
+    "zh": "Command failed ({cmd}): {stderr}"
+  },
+  "Comparing {base}..{head} ({count} files changed)": {
+    "bg": "Comparing {base}..{head} ({count} files changed)",
+    "de": "Comparing {base}..{head} ({count} files changed)",
+    "en": "Comparing {base}..{head} ({count} files changed)",
+    "ru": "Comparing {base}..{head} ({count} files changed)",
+    "zh": "Comparing {base}..{head} ({count} files changed)"
+  },
+  "Configuring branch protection for {branch}...": {
+    "bg": "Конфигуриране на защита на клона {branch}...",
+    "de": "Konfiguriere Branch-Schutz für {branch}...",
+    "en": "Configuring branch protection for {branch}...",
+    "ru": "Настройка защиты ветки {branch}...",
+    "zh": "正在配置 {branch} 的分支保护..."
+  },
+  "Configuring repository settings...": {
+    "bg": "Конфигуриране на настройките на хранилището...",
+    "de": "Repository-Einstellungen konfigurieren...",
+    "en": "Configuring repository settings...",
+    "ru": "Настройка параметров репозитория...",
+    "zh": "正在配置仓库设置..."
+  },
+  "Could not extract conventional commit message from PR commits.": {
+    "bg": "Could not extract conventional commit message from PR commits.",
+    "de": "Could not extract conventional commit message from PR commits.",
+    "en": "Could not extract conventional commit message from PR commits.",
+    "ru": "Could not extract conventional commit message from PR commits.",
+    "zh": "Could not extract conventional commit message from PR commits."
+  },
+  "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.": {
+    "bg": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "de": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "en": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "ru": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "zh": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task."
+  },
+  "Could not find __version__ in {file}": {
+    "bg": "Could not find __version__ in {file}",
+    "de": "Could not find __version__ in {file}",
+    "en": "Could not find __version__ in {file}",
+    "ru": "Could not find __version__ in {file}",
+    "zh": "Could not find __version__ in {file}"
+  },
+  "Could not parse test execution time from output.": {
+    "bg": "Could not parse test execution time from output.",
+    "de": "Could not parse test execution time from output.",
+    "en": "Could not parse test execution time from output.",
+    "ru": "Could not parse test execution time from output.",
+    "zh": "Could not parse test execution time from output."
+  },
+  "Created issue #{issue_id}: {title}": {
+    "bg": "Created issue #{issue_id}: {title}",
+    "de": "Created issue #{issue_id}: {title}",
+    "en": "Created issue #{issue_id}: {title}",
+    "ru": "Created issue #{issue_id}: {title}",
+    "zh": "Created issue #{issue_id}: {title}"
+  },
+  "Created release commit.": {
+    "bg": "Created release commit.",
+    "de": "Created release commit.",
+    "en": "Created release commit.",
+    "ru": "Created release commit.",
+    "zh": "Created release commit."
+  },
+  "Docker daemon already running": {
+    "bg": "Докер демонът вече работи",
+    "de": "Docker-Daemon läuft bereits",
+    "en": "Docker daemon already running",
+    "ru": "Демон Docker уже работает",
+    "zh": "Docker 守护进程已在运行"
+  },
+  "Docker daemon failed to start": {
+    "bg": "Docker daemon failed to start",
+    "de": "Docker-Daemon konnte nicht gestartet werden",
+    "en": "Docker daemon failed to start",
+    "ru": "Не удалось запустить Docker-демон",
+    "zh": "Docker 守护进程启动失败"
+  },
+  "Docker daemon started": {
+    "bg": "Docker daemon started",
+    "de": "Docker-Daemon gestartet",
+    "en": "Docker daemon started",
+    "ru": "Docker-демон запущен",
+    "zh": "Docker 守护进程已启动"
+  },
+  "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.": {
+    "bg": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "de": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "en": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "ru": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "zh": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently."
+  },
+  "ERROR: REPO_TOKEN is not set.": {
+    "bg": "ГРЕШКА: REPO_TOKEN не е зададен.",
+    "de": "FEHLER: REPO_TOKEN ist nicht gesetzt.",
+    "en": "ERROR: REPO_TOKEN is not set.",
+    "ru": "ОШИБКА: REPO_TOKEN не задан.",
+    "zh": "错误：未设置 REPO_TOKEN。"
+  },
+  "ERROR: Repository name not specified. Use --repo or set DEVX_REPO_NAME.": {
+    "bg": "ГРЕШКА: Името на хранилището не е указано. Използвайте --repo или задайте DEVX_REPO_NAME.",
+    "de": "FEHLER: Repository-Name nicht angegeben. Verwenden Sie --repo oder setzen Sie DEVX_REPO_NAME.",
+    "en": "ERROR: Repository name not specified. Use --repo or set DEVX_REPO_NAME.",
+    "ru": "ОШИБКА: Имя репозитория не указано. Используйте --repo или задайте DEVX_REPO_NAME.",
+    "zh": "错误：未指定仓库名称。请使用 --repo 或设置 DEVX_REPO_NAME。"
+  },
+  "ERROR: Tag consistency check failed. Existing tags are misaligned:": {
+    "bg": "ERROR: Tag consistency check failed. Existing tags are misaligned:",
+    "de": "ERROR: Tag consistency check failed. Existing tags are misaligned:",
+    "en": "ERROR: Tag consistency check failed. Existing tags are misaligned:",
+    "ru": "ERROR: Tag consistency check failed. Existing tags are misaligned:",
+    "zh": "ERROR: Tag consistency check failed. Existing tags are misaligned:"
+  },
+  "ERROR: VIKUNJA_TOKEN is not set.": {
+    "bg": "ГРЕШКА: VIKUNJA_TOKEN не е зададен.",
+    "de": "FEHLER: VIKUNJA_TOKEN ist nicht gesetzt.",
+    "en": "ERROR: VIKUNJA_TOKEN is not set.",
+    "ru": "ОШИБКА: VIKUNJA_TOKEN не задан.",
+    "zh": "错误：未设置 VIKUNJA_TOKEN。"
+  },
+  "ERROR: mapping.json not found at {path}": {
+    "bg": "ERROR: mapping.json not found at {path}",
+    "de": "ERROR: mapping.json not found at {path}",
+    "en": "ERROR: mapping.json not found at {path}",
+    "ru": "ERROR: mapping.json not found at {path}",
+    "zh": "ERROR: mapping.json not found at {path}"
+  },
+  "FAILED: {pair} exited with code {code}": {
+    "bg": "FAILED: {pair} exited with code {code}",
+    "de": "FAILED: {pair} exited with code {code}",
+    "en": "FAILED: {pair} exited with code {code}",
+    "ru": "FAILED: {pair} exited with code {code}",
+    "zh": "FAILED: {pair} exited with code {code}"
+  },
+  "Failed to create issue via tea: {error}": {
+    "bg": "Failed to create issue via tea: {error}",
+    "de": "Failed to create issue via tea: {error}",
+    "en": "Failed to create issue via tea: {error}",
+    "ru": "Failed to create issue via tea: {error}",
+    "zh": "Failed to create issue via tea: {error}"
+  },
+  "Found {count} existing wiki pages.": {
+    "bg": "Found {count} existing wiki pages.",
+    "de": "Found {count} existing wiki pages.",
+    "en": "Found {count} existing wiki pages.",
+    "ru": "Found {count} existing wiki pages.",
+    "zh": "Found {count} existing wiki pages."
+  },
+  "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.": {
+    "bg": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "de": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "en": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "ru": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "zh": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation."
+  },
+  "Generated {file} with prefix '{prefix}'.": {
+    "bg": "Generated {file} with prefix '{prefix}'.",
+    "de": "Generated {file} with prefix '{prefix}'.",
+    "en": "Generated {file} with prefix '{prefix}'.",
+    "ru": "Generated {file} with prefix '{prefix}'.",
+    "zh": "Generated {file} with prefix '{prefix}'."
   },
   "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.": {
-    "en": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
     "bg": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
     "de": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
+    "en": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
     "ru": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
     "zh": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag."
   },
-  "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.": {
-    "en": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
-    "bg": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
-    "de": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
-    "ru": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
-    "zh": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping."
+  "HEAD is a release commit for v{version} but tag {tag} points to a different commit ({tag_commit} vs HEAD {head_commit}). This indicates a tag/commit misalignment.": {
+    "bg": "HEAD is a release commit for v{version} but tag {tag} points to a different commit ({tag_commit} vs HEAD {head_commit}). This indicates a tag/commit misalignment.",
+    "de": "HEAD is a release commit for v{version} but tag {tag} points to a different commit ({tag_commit} vs HEAD {head_commit}). This indicates a tag/commit misalignment.",
+    "en": "HEAD is a release commit for v{version} but tag {tag} points to a different commit ({tag_commit} vs HEAD {head_commit}). This indicates a tag/commit misalignment.",
+    "ru": "HEAD is a release commit for v{version} but tag {tag} points to a different commit ({tag_commit} vs HEAD {head_commit}). This indicates a tag/commit misalignment.",
+    "zh": "HEAD is a release commit for v{version} but tag {tag} points to a different commit ({tag_commit} vs HEAD {head_commit}). This indicates a tag/commit misalignment."
   },
-  "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.": {
-    "en": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
-    "bg": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
-    "de": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
-    "ru": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
-    "zh": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update."
+  "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.": {
+    "bg": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
+    "de": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
+    "en": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
+    "ru": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
+    "zh": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping."
   },
-  "PR number must be an integer, got: {pr_number}": {
-    "en": "PR number must be an integer, got: {pr_number}",
-    "bg": "PR number must be an integer, got: {pr_number}",
-    "de": "PR number must be an integer, got: {pr_number}",
-    "ru": "PR number must be an integer, got: {pr_number}",
-    "zh": "PR number must be an integer, got: {pr_number}"
+  "HTTP error: {status} — {message}": {
+    "bg": "HTTP грешка: {status} — {message}",
+    "de": "HTTP-Fehler: {status} — {message}",
+    "en": "HTTP error: {status} — {message}",
+    "ru": "Ошибка HTTP: {status} — {message}",
+    "zh": "HTTP 错误: {status} — {message}"
   },
-  "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.": {
-    "en": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
-    "bg": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
-    "de": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
-    "ru": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
-    "zh": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history."
+  "HTTP {status} Forbidden — your token lacks admin rights.\nMake sure the token belongs to a repo owner or organisation admin.\nAlternatively, configure branch protection manually in Settings → Branches.": {
+    "bg": "HTTP {status} Забранено — вашият токен няма администраторски права.\nУверете се, че токенът принадлежи на собственик на хранилище или администратор на организация.\nАлтернативно, конфигурирайте защитата на клона ръчно в Настройки → Клонове.",
+    "de": "HTTP {status} Verboten — Ihr Token hat keine Admin-Rechte.\nStellen Sie sicher, dass das Token einem Repository-Besitzer oder Organisations-Admin gehört.\nAlternativ können Sie den Branch-Schutz manuell unter Einstellungen → Branches konfigurieren.",
+    "en": "HTTP {status} Forbidden — your token lacks admin rights.\nMake sure the token belongs to a repo owner or organisation admin.\nAlternatively, configure branch protection manually in Settings → Branches.",
+    "ru": "HTTP {status} Запрещено — у вашего токена нет прав администратора.\nУбедитесь, что токен принадлежит владельцу репозитория или администратору организации.\nЛибо настройте защиту ветки вручную в разделе Настройки → Ветки.",
+    "zh": "HTTP {status} 禁止访问 — 您的令牌缺少管理员权限。\n请确保令牌属于仓库所有者或组织管理员。\n或者，您可以在 设置 → 分支 中手动配置分支保护。"
   },
-  "Repo must be in 'owner/name' format, got: {repo}": {
-    "en": "Repo must be in 'owner/name' format, got: {repo}",
-    "bg": "Repo must be in 'owner/name' format, got: {repo}",
-    "de": "Repo must be in 'owner/name' format, got: {repo}",
-    "ru": "Repo must be in 'owner/name' format, got: {repo}",
-    "zh": "Repo must be in 'owner/name' format, got: {repo}"
+  "Head branch is behind master. Pulling and rebasing...": {
+    "bg": "Head branch is behind master. Pulling and rebasing...",
+    "de": "Head branch is behind master. Pulling and rebasing...",
+    "en": "Head branch is behind master. Pulling and rebasing...",
+    "ru": "Head branch is behind master. Pulling and rebasing...",
+    "zh": "Head branch is behind master. Pulling and rebasing..."
+  },
+  "Host Docker not available, starting local dockerd...": {
+    "bg": "Хост Docker не е наличен, стартиране на локален dockerd...",
+    "de": "Host-Docker nicht verfügbar, lokaler dockerd wird gestartet...",
+    "en": "Host Docker not available, starting local dockerd...",
+    "ru": "Хост Docker недоступен, запускается локальный dockerd...",
+    "zh": "主机 Docker 不可用，正在启动本地 dockerd..."
+  },
+  "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}": {
+    "bg": "Инфраструктурен commit (без идентификатор на задача DEVX-N), пропускаме обновяването на Vikunja: {msg}",
+    "de": "Infrastruktur-Commit (keine DEVX-N Task-ID), Vikunja-Update wird übersprungen: {msg}",
+    "en": "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}",
+    "ru": "Инфраструктурный коммит (без ID задачи DEVX-N), пропуск обновления Vikunja: {msg}",
+    "zh": "基础设施提交（无 DEVX-N 任务 ID），跳过 Vikunja 更新: {msg}"
+  },
+  "Integration tests cancelled — another runner failed.": {
+    "bg": "Integration tests cancelled — another runner failed.",
+    "de": "Integration tests cancelled — another runner failed.",
+    "en": "Integration tests cancelled — another runner failed.",
+    "ru": "Integration tests cancelled — another runner failed.",
+    "zh": "Integration tests cancelled — another runner failed."
+  },
+  "Integration tests failed with exit code {code}": {
+    "bg": "Integration tests failed with exit code {code}",
+    "de": "Integration tests failed with exit code {code}",
+    "en": "Integration tests failed with exit code {code}",
+    "ru": "Integration tests failed with exit code {code}",
+    "zh": "Integration tests failed with exit code {code}"
+  },
+  "Integration tests passed.": {
+    "bg": "Integration tests passed.",
+    "de": "Integration tests passed.",
+    "en": "Integration tests passed.",
+    "ru": "Integration tests passed.",
+    "zh": "Integration tests passed."
+  },
+  "Lint failed — refusing to release. Fix lint errors first.\n{stderr}": {
+    "bg": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "de": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "en": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "ru": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "zh": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}"
+  },
+  "Lint passed.": {
+    "bg": "Lint passed.",
+    "de": "Lint passed.",
+    "en": "Lint passed.",
+    "ru": "Lint passed.",
+    "zh": "Lint passed."
   },
   "Mapped file {file} is empty. Update the content or remove from mapping.json.": {
-    "en": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
     "bg": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
     "de": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
+    "en": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
     "ru": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
     "zh": "Mapped file {file} is empty. Update the content or remove from mapping.json."
   },
+  "Mapped file {file} not found. Update mapping.json or create the file.": {
+    "bg": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "de": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "en": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "ru": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "zh": "Mapped file {file} not found. Update mapping.json or create the file."
+  },
+  "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.": {
+    "bg": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "de": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "en": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "ru": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "zh": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually."
+  },
+  "Merge failed with HTTP {status}: {message}\nPlease check the PR is ready and you have merge rights.": {
+    "bg": "Сливането неуспешно с HTTP {status}: {message}\nПроверете дали PR е готов и имате права за сливане.",
+    "de": "Merge fehlgeschlagen mit HTTP {status}: {message}\nBitte prüfen Sie, ob der PR bereit ist und Sie Merge-Rechte haben.",
+    "en": "Merge failed with HTTP {status}: {message}\nPlease check the PR is ready and you have merge rights.",
+    "ru": "Слияние не удалось: HTTP {status}: {message}\nПроверьте, что PR готов и у вас есть права на слияние.",
+    "zh": "合并失败: HTTP {status}: {message}\n请检查 PR 是否准备就绪且您具有合并权限。"
+  },
+  "Merged {count} reports: {tests} tests, {failures} failures → {output}": {
+    "bg": "Merged {count} reports: {tests} tests, {failures} failures → {output}",
+    "de": "Merged {count} reports: {tests} tests, {failures} failures → {output}",
+    "en": "Merged {count} reports: {tests} tests, {failures} failures → {output}",
+    "ru": "Merged {count} reports: {tests} tests, {failures} failures → {output}",
+    "zh": "Merged {count} reports: {tests} tests, {failures} failures → {output}"
+  },
+  "Module {mod} has no main() function": {
+    "bg": "Модул {mod} няма функция main()",
+    "de": "Modul {mod} hat keine main()-Funktion",
+    "en": "Module {mod} has no main() function",
+    "ru": "Модуль {mod} не имеет функции main()",
+    "zh": "模块 {mod} 没有 main() 函数"
+  },
+  "Molecule directory not found: {path}": {
+    "bg": "Директорията на molecule не е намерена: {path}",
+    "de": "Molecule-Verzeichnis nicht gefunden: {path}",
+    "en": "Molecule directory not found: {path}",
+    "ru": "Директория molecule не найдена: {path}",
+    "zh": "未找到 molecule 目录: {path}"
+  },
+  "Gitea release {tag} already exists — skipping creation.": {
+    "bg": "Gitea release {tag} вече съществува — прескачане на създаването.",
+    "de": "Gitea-Release {tag} existiert bereits — Erstellung übersprungen.",
+    "en": "Gitea release {tag} already exists — skipping creation.",
+    "ru": "Gitea release {tag} уже существует — пропуск создания.",
+    "zh": "Gitea release {tag} 已存在 — 跳过创建。"
+  },
+  "Nice! Gitea release {tag} created.": {
+    "bg": "Отлично! Gitea release {tag} е създаден.",
+    "de": "Prima! Gitea-Release {tag} erstellt.",
+    "en": "Nice! Gitea release {tag} created.",
+    "ru": "Отлично! Gitea release {tag} создан.",
+    "zh": "不错！Gitea release {tag} 已创建。"
+  },
+  "Nice! PR #{pr_number} squash-merged with title: {merge_title}": {
+    "bg": "Отлично! PR #{pr_number} е squash-merge-нат със заглавие: {merge_title}",
+    "de": "Prima! PR #{pr_number} wurde mit Titel {merge_title} squash-gemergt.",
+    "en": "Nice! PR #{pr_number} squash-merged with title: {merge_title}",
+    "ru": "Отлично! PR #{pr_number} squash-merge с заголовком: {merge_title}",
+    "zh": "不错！PR #{pr_number} 已 squash 合并，标题: {merge_title}"
+  },
+  "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.": {
+    "bg": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "de": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "en": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "ru": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "zh": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered."
+  },
+  "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.": {
+    "bg": "Отлично! Задача Vikunja {task_id} (ID {vikunja_id}) е обновена и маркирана като готова.",
+    "de": "Prima! Vikunja-Aufgabe {task_id} (ID {vikunja_id}) aktualisiert und als erledigt markiert.",
+    "en": "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.",
+    "ru": "Отлично! Задача Vikunja {task_id} (ID {vikunja_id}) обновлена и отмечена как выполненная.",
+    "zh": "不错！Vikunja 任务 {task_id} (ID {vikunja_id}) 已更新并标记为完成。"
+  },
+  "No JUnit reports found matching {pattern} — skipping merge.": {
+    "bg": "No JUnit reports found matching {pattern} — skipping merge.",
+    "de": "No JUnit reports found matching {pattern} — skipping merge.",
+    "en": "No JUnit reports found matching {pattern} — skipping merge.",
+    "ru": "No JUnit reports found matching {pattern} — skipping merge.",
+    "zh": "No JUnit reports found matching {pattern} — skipping merge."
+  },
+  "No changes between {base} and {head}.": {
+    "bg": "No changes between {base} and {head}.",
+    "de": "No changes between {base} and {head}.",
+    "en": "No changes between {base} and {head}.",
+    "ru": "No changes between {base} and {head}.",
+    "zh": "No changes between {base} and {head}."
+  },
+  "No staged changes — version and changelog already up to date.": {
+    "bg": "No staged changes — version and changelog already up to date.",
+    "de": "No staged changes — version and changelog already up to date.",
+    "en": "No staged changes — version and changelog already up to date.",
+    "ru": "No staged changes — version and changelog already up to date.",
+    "zh": "No staged changes — version and changelog already up to date."
+  },
+  "No tags found — treating all changes as user-facing.": {
+    "bg": "No tags found — treating all changes as user-facing.",
+    "de": "No tags found — treating all changes as user-facing.",
+    "en": "No tags found — treating all changes as user-facing.",
+    "ru": "No tags found — treating all changes as user-facing.",
+    "zh": "No tags found — treating all changes as user-facing."
+  },
+  "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.": {
+    "bg": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "de": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "en": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "ru": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "zh": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID."
+  },
+  "No unreleased changes found. Nothing to release.": {
+    "bg": "No unreleased changes found. Nothing to release.",
+    "de": "No unreleased changes found. Nothing to release.",
+    "en": "No unreleased changes found. Nothing to release.",
+    "ru": "No unreleased changes found. Nothing to release.",
+    "zh": "No unreleased changes found. Nothing to release."
+  },
+  "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.": {
+    "bg": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "de": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "en": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "ru": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "zh": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release."
+  },
+  "Note: Self-approval not allowed. Posting COMMENT instead.": {
+    "bg": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "de": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "en": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "ru": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "zh": "Note: Self-approval not allowed. Posting COMMENT instead."
+  },
+  "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE": {
+    "bg": "Опа! Съобщението за commit трябва да следва конвенционален формат.\n  Очаква се: <type>: <description>\n  Получено: {subject}\n  Разрешени типове: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
+    "de": "Ups! Commit-Nachricht muss dem konventionellen Commit-Format folgen.\n  Erwartet: <type>: <description>\n  Erhalten: {subject}\n  Erlaubte Typen: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
+    "en": "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
+    "ru": "Ой! Сообщение коммита должно соответствовать формату conventional commit.\n  Ожидается: <type>: <description>\n  Получено: {subject}\n  Допустимые типы: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
+    "zh": "哎呀！提交消息必须遵循 conventional commit 格式。\n  预期格式: <type>: <description>\n  实际: {subject}\n  允许的类型: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE"
+  },
+  "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.": {
+    "bg": "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.",
+    "de": "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.",
+    "en": "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.",
+    "ru": "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.",
+    "zh": "Oops! Do not include task ID ({prefix}-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI."
+  },
+  "Oops! Gitea PyPI registry publish failed:\n{stderr}": {
+    "bg": "Опа! Публикуването в Gitea PyPI registry неуспешно:\n{stderr}",
+    "de": "Ups! Veröffentlichung in der Gitea PyPI-Registry fehlgeschlagen:\n{stderr}",
+    "en": "Oops! Gitea PyPI registry publish failed:\n{stderr}",
+    "ru": "Ой! Публикация в Gitea PyPI registry не удалась:\n{stderr}",
+    "zh": "哎呀！Gitea PyPI registry 发布失败：\n{stderr}"
+  },
+  "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: {prefix}-N: <type>: <description>\n  Got:      {subject}": {
+    "bg": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: {prefix}-N: <type>: <description>\n  Got:      {subject}",
+    "de": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: {prefix}-N: <type>: <description>\n  Got:      {subject}",
+    "en": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: {prefix}-N: <type>: <description>\n  Got:      {subject}",
+    "ru": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: {prefix}-N: <type>: <description>\n  Got:      {subject}",
+    "zh": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: {prefix}-N: <type>: <description>\n  Got:      {subject}"
+  },
+  "Oops! Master branch commits must start with a task ID.\n  Expected: {prefix}-N: <conventional commit message>\n  Got:      {subject}": {
+    "bg": "Oops! Master branch commits must start with a task ID.\n  Expected: {prefix}-N: <conventional commit message>\n  Got:      {subject}",
+    "de": "Oops! Master branch commits must start with a task ID.\n  Expected: {prefix}-N: <conventional commit message>\n  Got:      {subject}",
+    "en": "Oops! Master branch commits must start with a task ID.\n  Expected: {prefix}-N: <conventional commit message>\n  Got:      {subject}",
+    "ru": "Oops! Master branch commits must start with a task ID.\n  Expected: {prefix}-N: <conventional commit message>\n  Got:      {subject}",
+    "zh": "Oops! Master branch commits must start with a task ID.\n  Expected: {prefix}-N: <conventional commit message>\n  Got:      {subject}"
+  },
+  "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}": {
+    "bg": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "de": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "en": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "ru": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "zh": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}"
+  },
+  "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}": {
+    "bg": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "de": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "en": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "ru": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "zh": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}"
+  },
+  "Oops! Package build failed:\n{stderr}": {
+    "bg": "Опа! Сборката на пакета неуспешна:\n{stderr}",
+    "de": "Ups! Paket-Build fehlgeschlagen:\n{stderr}",
+    "en": "Oops! Package build failed:\n{stderr}",
+    "ru": "Ой! Сборка пакета не удалась:\n{stderr}",
+    "zh": "哎呀！包构建失败：\n{stderr}"
+  },
+  "Oops! PyPI publish failed:\n{stderr}": {
+    "bg": "Опа! Публикуването в PyPI неуспешно:\n{stderr}",
+    "de": "Ups! PyPI-Veröffentlichung fehlgeschlagen:\n{stderr}",
+    "en": "Oops! PyPI publish failed:\n{stderr}",
+    "ru": "Ой! Публикация в PyPI не удалась:\n{stderr}",
+    "zh": "哎呀！PyPI 发布失败：\n{stderr}"
+  },
+  "Parsed owner={owner}, repo={repo} from DEVX_REPO_NAME": {
+    "bg": "Разбор на owner={owner}, repo={repo} от DEVX_REPO_NAME",
+    "de": "Owner={owner}, repo={repo} aus DEVX_REPO_NAME analysiert",
+    "en": "Parsed owner={owner}, repo={repo} from DEVX_REPO_NAME",
+    "ru": "Извлечён owner={owner}, repo={repo} из DEVX_REPO_NAME",
+    "zh": "从 DEVX_REPO_NAME 解析 owner={owner}, repo={repo}"
+  },
+  "PASSED: {pair}": {
+    "bg": "PASSED: {pair}",
+    "de": "PASSED: {pair}",
+    "en": "PASSED: {pair}",
+    "ru": "PASSED: {pair}",
+    "zh": "PASSED: {pair}"
+  },
+  "PR number must be an integer, got: {pr_number}": {
+    "bg": "PR number must be an integer, got: {pr_number}",
+    "de": "PR number must be an integer, got: {pr_number}",
+    "en": "PR number must be an integer, got: {pr_number}",
+    "ru": "PR number must be an integer, got: {pr_number}",
+    "zh": "PR number must be an integer, got: {pr_number}"
+  },
+  "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}": {
+    "bg": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "de": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "en": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "ru": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "zh": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}"
+  },
+  "PYPI_TOKEN not set and no registry URL configured — skipping PyPI publish. No worries, we'll just create the Gitea release.": {
+    "bg": "PYPI_TOKEN не е зададен и няма конфигуриран URL на registry — пропускаме публикуването в PyPI. Без притеснения, просто ще създадем Gitea release.",
+    "de": "PYPI_TOKEN nicht gesetzt und keine Registry-URL konfiguriert — PyPI-Veröffentlichung wird übersprungen. Keine Sorge, wir erstellen einfach das Gitea-Release.",
+    "en": "PYPI_TOKEN not set and no registry URL configured — skipping PyPI publish. No worries, we'll just create the Gitea release.",
+    "ru": "PYPI_TOKEN не задан и URL registry не настроен — пропускаем публикацию в PyPI. Не беспокойтесь, мы просто создадим Gitea release.",
+    "zh": "未设置 PYPI_TOKEN 且未配置 registry URL — 跳过 PyPI 发布。别担心，我们直接创建 Gitea release。"
+  },
+  "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.": {
+    "bg": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
+    "de": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
+    "en": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
+    "ru": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
+    "zh": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit."
+  },
+  "Published to Gitea PyPI registry.": {
+    "bg": "Публикувано в Gitea PyPI registry.",
+    "de": "In der Gitea PyPI-Registry veröffentlicht.",
+    "en": "Published to Gitea PyPI registry.",
+    "ru": "Опубликовано в Gitea PyPI registry.",
+    "zh": "已发布到 Gitea PyPI registry。"
+  },
+  "Published to PyPI.": {
+    "bg": "Публикувано в PyPI.",
+    "de": "In PyPI veröffentlicht.",
+    "en": "Published to PyPI.",
+    "ru": "Опубликовано в PyPI.",
+    "zh": "已发布到 PyPI。"
+  },
+  "Pushed release commit to master.": {
+    "bg": "Pushed release commit to master.",
+    "de": "Pushed release commit to master.",
+    "en": "Pushed release commit to master.",
+    "ru": "Pushed release commit to master.",
+    "zh": "Pushed release commit to master."
+  },
+  "Rebased and pushed. Retrying merge...": {
+    "bg": "Rebased and pushed. Retrying merge...",
+    "de": "Rebased and pushed. Retrying merge...",
+    "en": "Rebased and pushed. Retrying merge...",
+    "ru": "Rebased and pushed. Retrying merge...",
+    "zh": "Rebased and pushed. Retrying merge..."
+  },
+  "Release creation failed: {error}": {
+    "bg": "Release creation failed: {error}",
+    "de": "Release creation failed: {error}",
+    "en": "Release creation failed: {error}",
+    "ru": "Release creation failed: {error}",
+    "zh": "Release creation failed: {error}"
+  },
+  "Release must be run on master, currently on '{branch}'.": {
+    "bg": "Release must be run on master, currently on '{branch}'.",
+    "de": "Release must be run on master, currently on '{branch}'.",
+    "en": "Release must be run on master, currently on '{branch}'.",
+    "ru": "Release must be run on master, currently on '{branch}'.",
+    "zh": "Release must be run on master, currently on '{branch}'."
+  },
+  "Repo must be in 'owner/name' format, got: {repo}": {
+    "bg": "Repo must be in 'owner/name' format, got: {repo}",
+    "de": "Repo must be in 'owner/name' format, got: {repo}",
+    "en": "Repo must be in 'owner/name' format, got: {repo}",
+    "ru": "Repo must be in 'owner/name' format, got: {repo}",
+    "zh": "Repo must be in 'owner/name' format, got: {repo}"
+  },
+  "Repository configuration complete.": {
+    "bg": "Конфигурирането на хранилището е завършено.",
+    "de": "Repository-Konfiguration abgeschlossen.",
+    "en": "Repository configuration complete.",
+    "ru": "Конфигурация репозитория завершена.",
+    "zh": "仓库配置完成。"
+  },
+  "Roles directory not found: {path}": {
+    "bg": "Roles directory not found: {path}",
+    "de": "Roles directory not found: {path}",
+    "en": "Roles directory not found: {path}",
+    "ru": "Roles directory not found: {path}",
+    "zh": "Roles directory not found: {path}"
+  },
+  "Runner index {index} out of range (0..{max})": {
+    "bg": "Индексът на runner {index} е извън диапазона (0..{max})",
+    "de": "Runner-Index {index} außerhalb des Bereichs (0..{max})",
+    "en": "Runner index {index} out of range (0..{max})",
+    "ru": "Индекс runner {index} вне диапазона (0..{max})",
+    "zh": "Runner 索引 {index} 超出范围 (0..{max})"
+  },
+  "Running lint checks...": {
+    "bg": "Running lint checks...",
+    "de": "Running lint checks...",
+    "en": "Running lint checks...",
+    "ru": "Running lint checks...",
+    "zh": "Running lint checks..."
+  },
+  "Running tests...": {
+    "bg": "Running tests...",
+    "de": "Running tests...",
+    "en": "Running tests...",
+    "ru": "Running tests...",
+    "zh": "Running tests..."
+  },
+  "Running: {scenario} on {platform}": {
+    "bg": "Running: {scenario} on {platform}",
+    "de": "Running: {scenario} on {platform}",
+    "en": "Running: {scenario} on {platform}",
+    "ru": "Running: {scenario} on {platform}",
+    "zh": "Running: {scenario} on {platform}"
+  },
+  "Skipping commit push — no staged changes.": {
+    "bg": "Skipping commit push — no staged changes.",
+    "de": "Skipping commit push — no staged changes.",
+    "en": "Skipping commit push — no staged changes.",
+    "ru": "Skipping commit push — no staged changes.",
+    "zh": "Skipping commit push — no staged changes."
+  },
+  "Syncing {count} documentation pages to wiki...": {
+    "bg": "Syncing {count} documentation pages to wiki...",
+    "de": "Syncing {count} documentation pages to wiki...",
+    "en": "Syncing {count} documentation pages to wiki...",
+    "ru": "Syncing {count} documentation pages to wiki...",
+    "zh": "Syncing {count} documentation pages to wiki..."
+  },
+  "Tag consistency check failed.": {
+    "bg": "Tag consistency check failed.",
+    "de": "Tag consistency check failed.",
+    "en": "Tag consistency check failed.",
+    "ru": "Tag consistency check failed.",
+    "zh": "Tag consistency check failed."
+  },
+  "Tag v{version} already existed. Publish workflow should already have been triggered.": {
+    "bg": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "de": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "en": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "ru": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "zh": "Tag v{version} already existed. Publish workflow should already have been triggered."
+  },
+  "Tag {tag} already exists and points to HEAD. Skipping creation.": {
+    "bg": "Tag {tag} already exists and points to HEAD. Skipping creation.",
+    "de": "Tag {tag} already exists and points to HEAD. Skipping creation.",
+    "en": "Tag {tag} already exists and points to HEAD. Skipping creation.",
+    "ru": "Tag {tag} already exists and points to HEAD. Skipping creation.",
+    "zh": "Tag {tag} already exists and points to HEAD. Skipping creation."
+  },
+  "Tag {tag} already exists but points to {tag_commit} (expected HEAD {head_commit}). This indicates a tag/commit misalignment. Run 'python3 -m devx.ci.release --verify' for details.": {
+    "bg": "Tag {tag} already exists but points to {tag_commit} (expected HEAD {head_commit}). This indicates a tag/commit misalignment. Run 'python3 -m devx.ci.release --verify' for details.",
+    "de": "Tag {tag} already exists but points to {tag_commit} (expected HEAD {head_commit}). This indicates a tag/commit misalignment. Run 'python3 -m devx.ci.release --verify' for details.",
+    "en": "Tag {tag} already exists but points to {tag_commit} (expected HEAD {head_commit}). This indicates a tag/commit misalignment. Run 'python3 -m devx.ci.release --verify' for details.",
+    "ru": "Tag {tag} already exists but points to {tag_commit} (expected HEAD {head_commit}). This indicates a tag/commit misalignment. Run 'python3 -m devx.ci.release --verify' for details.",
+    "zh": "Tag {tag} already exists but points to {tag_commit} (expected HEAD {head_commit}). This indicates a tag/commit misalignment. Run 'python3 -m devx.ci.release --verify' for details."
+  },
+  "Task ID: {task_id}": {
+    "bg": "Task ID: {task_id}",
+    "de": "Task ID: {task_id}",
+    "en": "Task ID: {task_id}",
+    "ru": "Task ID: {task_id}",
+    "zh": "Task ID: {task_id}"
+  },
+  "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). Optimise: use lighter fixtures, reduce I/O, or mock external calls.": {
+    "bg": "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). Optimise: use lighter fixtures, reduce I/O, or mock external calls.",
+    "de": "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). Optimise: use lighter fixtures, reduce I/O, or mock external calls.",
+    "en": "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). Optimise: use lighter fixtures, reduce I/O, or mock external calls.",
+    "ru": "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). Optimise: use lighter fixtures, reduce I/O, or mock external calls.",
+    "zh": "Test '{name}' took {elapsed:.2f}s (limit: {limit}s). Optimise: use lighter fixtures, reduce I/O, or mock external calls."
+  },
+  "Tests failed — refusing to release. Fix test failures first.\n{stderr}": {
+    "bg": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "de": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "en": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "ru": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "zh": "Tests failed — refusing to release. Fix test failures first.\n{stderr}"
+  },
+  "Tests passed.": {
+    "bg": "Tests passed.",
+    "de": "Tests passed.",
+    "en": "Tests passed.",
+    "ru": "Tests passed.",
+    "zh": "Tests passed."
+  },
+  "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).": {
+    "bg": "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
+    "de": "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
+    "en": "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
+    "ru": "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
+    "zh": "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit)."
+  },
+  "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.": {
+    "bg": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "de": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "en": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "ru": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "zh": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures."
+  },
+  "Unknown check category '{check}'. Available: all, user-facing{tags}": {
+    "bg": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "de": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "en": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "ru": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "zh": "Unknown check category '{check}'. Available: all, user-facing{tags}"
+  },
+  "Updated version in {init}": {
+    "bg": "Updated version in {init}",
+    "de": "Updated version in {init}",
+    "en": "Updated version in {init}",
+    "ru": "Updated version in {init}",
+    "zh": "Updated version in {init}"
+  },
+  "Updated {changelog_file}": {
+    "bg": "Updated {changelog_file}",
+    "de": "Updated {changelog_file}",
+    "en": "Updated {changelog_file}",
+    "ru": "Updated {changelog_file}",
+    "zh": "Updated {changelog_file}"
+  },
   "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.": {
-    "en": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
     "bg": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
     "de": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
+    "en": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
     "ru": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
     "zh": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles."
   },
+  "Version file: {file}": {
+    "bg": "Version file: {file}",
+    "de": "Version file: {file}",
+    "en": "Version file: {file}",
+    "ru": "Version file: {file}",
+    "zh": "Version file: {file}"
+  },
+  "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.": {
+    "bg": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "de": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "en": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "ru": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "zh": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update."
+  },
+  "WARNING: --skip-tests passed — skipping test verification.": {
+    "bg": "WARNING: --skip-tests passed — skipping test verification.",
+    "de": "WARNING: --skip-tests passed — skipping test verification.",
+    "en": "WARNING: --skip-tests passed — skipping test verification.",
+    "ru": "WARNING: --skip-tests passed — skipping test verification.",
+    "zh": "WARNING: --skip-tests passed — skipping test verification."
+  },
+  "Warning: could not fetch tags from origin.": {
+    "bg": "Warning: could not fetch tags from origin.",
+    "de": "Warning: could not fetch tags from origin.",
+    "en": "Warning: could not fetch tags from origin.",
+    "ru": "Warning: could not fetch tags from origin.",
+    "zh": "Warning: could not fetch tags from origin."
+  },
+  "Wiki integrity check failed — {count} issue(s)": {
+    "bg": "Wiki integrity check failed — {count} issue(s)",
+    "de": "Wiki integrity check failed — {count} issue(s)",
+    "en": "Wiki integrity check failed — {count} issue(s)",
+    "ru": "Wiki integrity check failed — {count} issue(s)",
+    "zh": "Wiki integrity check failed — {count} issue(s)"
+  },
+  "Wiki verification failed — {failures} page(s) empty or mismatched": {
+    "bg": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "de": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "en": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "ru": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "zh": "Wiki verification failed — {failures} page(s) empty or mismatched"
+  },
+  "[dry-run] Would commit: release: v{version}": {
+    "bg": "[dry-run] Would commit: release: v{version}",
+    "de": "[dry-run] Would commit: release: v{version}",
+    "en": "[dry-run] Would commit: release: v{version}",
+    "ru": "[dry-run] Would commit: release: v{version}",
+    "zh": "[dry-run] Would commit: release: v{version}"
+  },
+  "[dry-run] Would create tag: v{version}": {
+    "bg": "[dry-run] Would create tag: v{version}",
+    "de": "[dry-run] Would create tag: v{version}",
+    "en": "[dry-run] Would create tag: v{version}",
+    "ru": "[dry-run] Would create tag: v{version}",
+    "zh": "[dry-run] Would create tag: v{version}"
+  },
+  "[dry-run] Would create tag: {tag}": {
+    "bg": "[dry-run] Would create tag: {tag}",
+    "de": "[dry-run] Would create tag: {tag}",
+    "en": "[dry-run] Would create tag: {tag}",
+    "ru": "[dry-run] Would create tag: {tag}",
+    "zh": "[dry-run] Would create tag: {tag}"
+  },
+  "[dry-run] Would push commit to master": {
+    "bg": "[dry-run] Would push commit to master",
+    "de": "[dry-run] Would push commit to master",
+    "en": "[dry-run] Would push commit to master",
+    "ru": "[dry-run] Would push commit to master",
+    "zh": "[dry-run] Would push commit to master"
+  },
+  "[dry-run] Would sync page: {title} ({chars} chars)": {
+    "bg": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "de": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "en": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "ru": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "zh": "[dry-run] Would sync page: {title} ({chars} chars)"
+  },
+  "[dry-run] Would update {changelog_file}": {
+    "bg": "[dry-run] Would update {changelog_file}",
+    "de": "[dry-run] Would update {changelog_file}",
+    "en": "[dry-run] Would update {changelog_file}",
+    "ru": "[dry-run] Would update {changelog_file}",
+    "zh": "[dry-run] Would update {changelog_file}"
+  },
+  "[dry-run] Would update {init}": {
+    "bg": "[dry-run] Would update {init}",
+    "de": "[dry-run] Would update {init}",
+    "en": "[dry-run] Would update {init}",
+    "ru": "[dry-run] Would update {init}",
+    "zh": "[dry-run] Would update {init}"
+  },
+  "active": {
+    "bg": "активен",
+    "de": "aktiv",
+    "en": "active",
+    "ru": "активен",
+    "zh": "活跃"
+  },
+  "completed": {
+    "bg": "завършен",
+    "de": "abgeschlossen",
+    "en": "completed",
+    "ru": "завершён",
+    "zh": "已完成"
+  },
+  "failed": {
+    "bg": "неуспешен",
+    "de": "fehlgeschlagen",
+    "en": "failed",
+    "ru": "неудачный",
+    "zh": "失败"
+  },
+  "git command failed ({cmd}): {stderr}": {
+    "bg": "git command failed ({cmd}): {stderr}",
+    "de": "git command failed ({cmd}): {stderr}",
+    "en": "git command failed ({cmd}): {stderr}",
+    "ru": "git command failed ({cmd}): {stderr}",
+    "zh": "git command failed ({cmd}): {stderr}"
+  },
+  "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.": {
+    "bg": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "de": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "en": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "ru": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "zh": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history."
+  },
+  "git-cliff returned empty version.": {
+    "bg": "git-cliff returned empty version.",
+    "de": "git-cliff returned empty version.",
+    "en": "git-cliff returned empty version.",
+    "ru": "git-cliff returned empty version.",
+    "zh": "git-cliff returned empty version."
+  },
+  "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).": {
+    "bg": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "de": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "en": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "ru": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "zh": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1)."
+  },
+  "in_progress": {
+    "bg": "в процес",
+    "de": "in Bearbeitung",
+    "en": "in progress",
+    "ru": "в процессе",
+    "zh": "进行中"
+  },
+  "inactive": {
+    "bg": "неактивен",
+    "de": "inaktiv",
+    "en": "inactive",
+    "ru": "неактивен",
+    "zh": "未激活"
+  },
   "mapping.json keys and values must be strings, got {k}={v}": {
-    "en": "mapping.json keys and values must be strings, got {k}={v}",
     "bg": "mapping.json keys and values must be strings, got {k}={v}",
     "de": "mapping.json keys and values must be strings, got {k}={v}",
+    "en": "mapping.json keys and values must be strings, got {k}={v}",
     "ru": "mapping.json keys and values must be strings, got {k}={v}",
     "zh": "mapping.json keys and values must be strings, got {k}={v}"
   },
   "mapping.json must be a dict of file-path -> page-title, got {type}": {
-    "en": "mapping.json must be a dict of file-path -> page-title, got {type}",
     "bg": "mapping.json must be a dict of file-path -> page-title, got {type}",
     "de": "mapping.json must be a dict of file-path -> page-title, got {type}",
+    "en": "mapping.json must be a dict of file-path -> page-title, got {type}",
     "ru": "mapping.json must be a dict of file-path -> page-title, got {type}",
     "zh": "mapping.json must be a dict of file-path -> page-title, got {type}"
   },
-  "Mapped file {file} not found. Update mapping.json or create the file.": {
-    "en": "Mapped file {file} not found. Update mapping.json or create the file.",
-    "bg": "Mapped file {file} not found. Update mapping.json or create the file.",
-    "de": "Mapped file {file} not found. Update mapping.json or create the file.",
-    "ru": "Mapped file {file} not found. Update mapping.json or create the file.",
-    "zh": "Mapped file {file} not found. Update mapping.json or create the file."
+  "pending": {
+    "bg": "в очакване",
+    "de": "ausstehend",
+    "en": "pending",
+    "ru": "ожидает",
+    "zh": "待处理"
   },
-  "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.": {
-    "en": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
-    "bg": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
-    "de": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
-    "ru": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
-    "zh": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID."
+  "unknown": {
+    "bg": "неизвестен",
+    "de": "unbekannt",
+    "en": "unknown",
+    "ru": "неизвестно",
+    "zh": "未知"
   },
-  "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).": {
-    "en": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
-    "bg": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
-    "de": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
-    "ru": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
-    "zh": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1)."
+  "{file} already exists. Use --force to overwrite.": {
+    "bg": "{file} already exists. Use --force to overwrite.",
+    "de": "{file} already exists. Use --force to overwrite.",
+    "en": "{file} already exists. Use --force to overwrite.",
+    "ru": "{file} already exists. Use --force to overwrite.",
+    "zh": "{file} already exists. Use --force to overwrite."
+  },
+  "Oops! No task ID found in branch name '{branch}'. Branch names must include the task ID prefix (e.g., DEVX-31-fix-bug).": {
+    "en": "Oops! No task ID found in branch name '{branch}'. Branch names must include the task ID prefix (e.g., DEVX-31-fix-bug).",
+    "bg": "Ой! Не е намерен ID на задача в името на клона '{branch}'. Имената на клонове трябва да включват префикса за ID на задача (напр. DEVX-31-fix-bug).",
+    "de": "Hoppla! Keine Task-ID im Branch-Namen '{branch}' gefunden. Branch-Namen müssen das Task-ID-Präfix enthalten (z.B. DEVX-31-fix-bug).",
+    "ru": "Ой! ID задачи не найден в имени ветки '{branch}'. Имена веток должны включать префикс ID задачи (например, DEVX-31-fix-bug).",
+    "zh": "哎呀！在分支名称 '{branch}' 中未找到任务 ID。分支名称必须包含任务 ID 前缀（例如 DEVX-31-fix-bug）。"
+  },
+  "WARNING: .taskid file ({file_id}) is deprecated and disagrees with branch name ({branch_id}). Delete .taskid from the repo — branch name is the sole source of truth.": {
+    "en": "WARNING: .taskid file ({file_id}) is deprecated and disagrees with branch name ({branch_id}). Delete .taskid from the repo — branch name is the sole source of truth.",
+    "bg": "ВНИМАНИЕ: Файлът .taskid ({file_id}) е остарял и не съвпада с името на клона ({branch_id}). Изтрийте .taskid от хранилището — името на клона е единственият източник на истината.",
+    "de": "WARNUNG: Die Datei .taskid ({file_id}) ist veraltet und stimmt nicht mit dem Branch-Namen ({branch_id}) überein. Löschen Sie .taskid aus dem Repo — der Branch-Name ist die einzige Wahrheitsquelle.",
+    "ru": "ВНИМАНИЕ: Файл .taskid ({file_id}) устарел и не совпадает с именем ветки ({branch_id}). Удалите .taskid из репозитория — имя ветки — единственный источник истины.",
+    "zh": "警告：.taskid 文件 ({file_id}) 已弃用，与分支名称 ({branch_id}) 不一致。请从仓库中删除 .taskid — 分支名称是唯一的真实来源。"
   }
 }

tests/unit/test_api_clients.py

@@ -566,7 +566,8 @@ class TestVikunjaClient:
             json={"done": True},
         )
 
-    def test_http_error_raises_api_error(self) -> None:
+    @patch("devx.api_clients.time.sleep")
+    def test_http_error_raises_api_error(self, mock_sleep: MagicMock) -> None:
         client = VikunjaClient("https://work.example.com", "tok")
         mock_resp = MagicMock()
         mock_resp.raise_for_status.side_effect = _mock_http_error(http.HTTPStatus.INTERNAL_SERVER_ERROR, "server error")

tests/unit/test_auto_merge.py

@@ -21,23 +21,31 @@ from devx.exceptions import APIError
 
 
 class TestReadTaskid:
-    def test_reads_from_file(self, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
-        monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-60\n")
-        assert read_taskid("some-branch") == "DEVX-60"
-
-    def test_falls_back_to_branch_name(self, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_extracts_from_branch_name(self, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
         assert read_taskid("DEVX-19-fix-bug") == "DEVX-19"
 
-    def test_returns_empty_when_no_file_no_match(self, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_returns_empty_when_no_match(self, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
         assert read_taskid("feature-branch") == ""
 
-    def test_empty_file_falls_back_to_branch(self, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_warns_on_stale_taskid_file(self, tmp_path, monkeypatch, capsys) -> None:  # type: ignore[no-untyped-def]
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / ".taskid").write_text("DEVX-60\n")
+        # Branch name takes priority, stale .taskid should produce deprecation warning
+        assert read_taskid("DEVX-19-fix-bug") == "DEVX-19"
+        captured = capsys.readouterr()
+        combined = captured.out + captured.err
+        assert "WARNING" in combined
+        assert "deprecated" in combined
+        assert "DEVX-60" in combined
+        assert "DEVX-19" in combined
+
+    def test_no_warning_when_taskid_file_absent(self, tmp_path, monkeypatch, capsys) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("\n")
         assert read_taskid("DEVX-42-test") == "DEVX-42"
+        captured = capsys.readouterr()
+        assert "WARNING" not in captured.out
 
 
 # -- extract_task_id (legacy fallback) --
@@ -200,7 +208,6 @@ class TestMain:
         self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
     ) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
 
         mock_client = MagicMock()
         mock_client.get_pr_commits.return_value = [
@@ -227,7 +234,7 @@ class TestMain:
     @patch("devx.ci.auto_merge.GiteaClient")
     def test_no_task_id_raises(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
-        # No .taskid file, no DEVX-N in branch name
+        # No DEVX-N in branch name
         runner = CliRunner()
         result = runner.invoke(main, ["feature-branch", "DEVX-19: test", "owner/repo", "7"])
         assert result.exit_code != 0
@@ -237,7 +244,6 @@ class TestMain:
     @patch("devx.ci.auto_merge.GiteaClient")
     def test_invalid_pr_title_raises(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
 
         runner = CliRunner()
         result = runner.invoke(main, ["DEVX-19-fix", "Bad title", "owner/repo", "7"])
@@ -251,7 +257,6 @@ class TestMain:
         self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
     ) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
 
         mock_client = MagicMock()
         mock_client.get_pr_commits.return_value = [
@@ -281,7 +286,6 @@ class TestMain:
         self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
     ) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
 
         mock_client = MagicMock()
         mock_client.get_pr_commits.return_value = [
@@ -306,7 +310,6 @@ class TestMain:
     ) -> None:  # type: ignore[no-untyped-def]
         """When no conventional commit message is found in PR commits, raises."""
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
 
         mock_client = MagicMock()
         mock_client.get_pr_commits.return_value = []
@@ -324,7 +327,6 @@ class TestMain:
     def test_invalid_pr_number_raises(self, tmp_path, monkeypatch) -> None:
         """Non-integer PR number should raise."""
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
         runner = CliRunner()
         result = runner.invoke(main, ["DEVX-19-fix", "DEVX-19: Test", "owner/repo", "not-a-number"])
         assert result.exit_code != 0
@@ -334,7 +336,6 @@ class TestMain:
     def test_invalid_repo_format_raises(self, tmp_path, monkeypatch) -> None:
         """Repo without owner/name should raise."""
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
         runner = CliRunner()
         result = runner.invoke(main, ["DEVX-19-fix", "DEVX-19: Test", "invalidrepo", "7"])
         assert result.exit_code != 0
@@ -348,7 +349,6 @@ class TestMain:
     ) -> None:  # type: ignore[no-untyped-def]
         """When rebase retry also fails, raises with helpful message."""
         monkeypatch.chdir(tmp_path)
-        (tmp_path / ".taskid").write_text("DEVX-19\n")
 
         mock_client = MagicMock()
         mock_client.get_pr_commits.return_value = [

tests/unit/test_check_test_speed.py

@@ -1,4 +1,4 @@
-"""Unit tests for scripts/check_test_speed.py."""
+"""Unit tests for devx.tools.check_test_speed."""
 
 from unittest.mock import MagicMock, patch
 
@@ -8,10 +8,13 @@ from click.testing import CliRunner
 
 from devx.tools.check_test_speed import (
     DEFAULT_MAX_SECONDS,
+    DEFAULT_MAX_SINGLE_SECONDS,
     TEST_COMMAND,
+    check_per_test_speed,
     check_speed,
     cli,
     parse_duration,
+    parse_per_test_durations,
     run_tests,
 )
 
@@ -23,12 +26,23 @@ class TestRunTests:
         stdout, stderr = run_tests()
         assert stdout == "out"
         assert stderr == "err"
-        mock_run.assert_called_once_with(
-            TEST_COMMAND,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
+        mock_run.assert_called_once()
+        call_kwargs = mock_run.call_args
+        assert call_kwargs.args[0] == TEST_COMMAND
+        assert call_kwargs.kwargs["capture_output"] is True
+        assert call_kwargs.kwargs["text"] is True
+        assert call_kwargs.kwargs["check"] is False
+        env = call_kwargs.kwargs["env"]
+        assert "--durations=0" in env["PYTEST_ADDOPTS"]
+
+    @patch("devx.tools.check_test_speed.subprocess.run")
+    def test_run_tests_preserves_existing_pytest_addopts(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="out", stderr="err", returncode=0)
+        with patch.dict("os.environ", {"PYTEST_ADDOPTS": "-x"}, clear=False):
+            run_tests()
+        env = mock_run.call_args.kwargs["env"]
+        assert "--durations=0" in env["PYTEST_ADDOPTS"]
+        assert "-x" in env["PYTEST_ADDOPTS"]
 
 
 class TestParseDuration:
@@ -48,6 +62,38 @@ class TestParseDuration:
         assert "Could not parse" in str(exc.value)
 
 
+class TestParsePerTestDurations:
+    def test_parses_call_lines(self) -> None:
+        output = "0.01s call     tests/test_foo.py::test_bar\n"
+        durations = parse_per_test_durations(output)
+        assert len(durations) == 1
+        assert durations[0] == ("tests/test_foo.py::test_bar", 0.01)
+
+    def test_parses_setup_and_teardown(self) -> None:
+        output = (
+            "0.02s setup    tests/test_foo.py::test_bar\n"
+            "0.01s call     tests/test_foo.py::test_bar\n"
+            "0.00s teardown tests/test_foo.py::test_bar\n"
+        )
+        durations = parse_per_test_durations(output)
+        assert len(durations) == 3
+        names = [d[0] for d in durations]
+        assert "tests/test_foo.py::test_bar" in names
+
+    def test_sorted_slowest_first(self) -> None:
+        output = "0.01s call     tests/test_a.py::test_slow\n0.50s call     tests/test_b.py::test_fast\n"
+        durations = parse_per_test_durations(output)
+        assert durations[0][1] >= durations[1][1]
+        assert durations[0][1] == 0.50
+
+    def test_empty_output(self) -> None:
+        assert parse_per_test_durations("") == []
+
+    def test_ignores_non_duration_lines(self) -> None:
+        output = "Some random line\n234 passed in 0.70s\n"
+        assert parse_per_test_durations(output) == []
+
+
 class TestCheckSpeed:
     def test_under_budget_passes(self) -> None:
         check_speed(1.0, 2.0)  # should not raise
@@ -64,6 +110,31 @@ class TestCheckSpeed:
         assert "max allowed: 2.0s" in msg
 
 
+class TestCheckPerTestSpeed:
+    def test_no_violations_when_all_fast(self) -> None:
+        durations = [("test_a", 0.1), ("test_b", 0.2)]
+        assert check_per_test_speed(durations, 0.5) == []
+
+    def test_violation_when_test_exceeds_limit(self) -> None:
+        durations = [("test_slow", 0.6), ("test_fast", 0.1)]
+        violations = check_per_test_speed(durations, 0.5)
+        assert len(violations) == 1
+        assert "test_slow" in violations[0]
+        assert "0.60s" in violations[0]
+
+    def test_multiple_violations(self) -> None:
+        durations = [("test_a", 0.7), ("test_b", 0.6), ("test_c", 0.1)]
+        violations = check_per_test_speed(durations, 0.5)
+        assert len(violations) == 2
+
+    def test_exact_limit_passes(self) -> None:
+        durations = [("test_a", 0.5)]
+        assert check_per_test_speed(durations, 0.5) == []
+
+    def test_empty_durations(self) -> None:
+        assert check_per_test_speed([], 0.5) == []
+
+
 def test_main_module_block() -> None:
     import devx.tools.check_test_speed as cts
 
@@ -77,39 +148,71 @@ class TestMain:
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
     def test_successful_run(
         self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
         mock_check: MagicMock,
         mock_parse: MagicMock,
         mock_run: MagicMock,
     ) -> None:
         mock_run.return_value = ("stdout\n", "stderr\n")
         mock_parse.return_value = 1.5
+        mock_parse_per.return_value = []
+        mock_check_per.return_value = []
 
         runner = CliRunner()
         result = runner.invoke(cli, [])
         assert result.exit_code == 0
         assert "1.50s" in result.output
-        assert "under 2.0s limit" in result.output
+        assert "under 10.0s limit" in result.output
         mock_run.assert_called_once()
         mock_parse.assert_called_once_with("stdout\n\nstderr\n")
         mock_check.assert_called_once_with(1.5, DEFAULT_MAX_SECONDS)
+        mock_parse_per.assert_called_once()
+        mock_check_per.assert_called_once_with([], DEFAULT_MAX_SINGLE_SECONDS)
 
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
-    def test_slow_tests_exit(
+    def test_slow_total_exits(
         self,
         mock_parse: MagicMock,
         mock_run: MagicMock,
     ) -> None:
         mock_run.return_value = ("out\n", "err\n")
-        mock_parse.return_value = 3.0
+        mock_parse.return_value = 15.0
 
         runner = CliRunner()
         result = runner.invoke(cli, [])
         assert result.exit_code == 1
         assert "too slow" in result.output.lower()
 
+    @patch("devx.tools.check_test_speed.run_tests")
+    @patch("devx.tools.check_test_speed.parse_duration")
+    @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
+    def test_per_test_violation_exits(
+        self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
+        mock_check: MagicMock,
+        mock_parse: MagicMock,
+        mock_run: MagicMock,
+    ) -> None:
+        mock_run.return_value = ("out\n", "err\n")
+        mock_parse.return_value = 3.0
+        mock_parse_per.return_value = [("test_slow", 0.8)]
+        mock_check_per.return_value = ["Test 'test_slow' took 0.80s (limit: 0.5s)."]
+
+        runner = CliRunner()
+        result = runner.invoke(cli, [])
+        assert result.exit_code == 1
+        assert "Per-test speed check FAILED" in result.output
+        assert "test_slow" in result.output
+
     @patch("devx.tools.check_test_speed.run_tests")
     def test_parse_failure_exits(
         self,
@@ -125,16 +228,67 @@ class TestMain:
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
     def test_custom_max_seconds(
         self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
         mock_check: MagicMock,
         mock_parse: MagicMock,
         mock_run: MagicMock,
     ) -> None:
         mock_run.return_value = ("out\n", "err\n")
         mock_parse.return_value = 0.5
+        mock_parse_per.return_value = []
+        mock_check_per.return_value = []
 
         runner = CliRunner()
         result = runner.invoke(cli, ["--max-seconds", "1.5"])
         assert result.exit_code == 0
         mock_check.assert_called_once_with(0.5, 1.5)
+
+    @patch("devx.tools.check_test_speed.run_tests")
+    @patch("devx.tools.check_test_speed.parse_duration")
+    @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
+    def test_disable_per_test_check(
+        self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
+        mock_check: MagicMock,
+        mock_parse: MagicMock,
+        mock_run: MagicMock,
+    ) -> None:
+        mock_run.return_value = ("out\n", "err\n")
+        mock_parse.return_value = 1.0
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--max-single-seconds", "0"])
+        assert result.exit_code == 0
+        mock_parse_per.assert_not_called()
+        mock_check_per.assert_not_called()
+
+    @patch("devx.tools.check_test_speed.run_tests")
+    @patch("devx.tools.check_test_speed.parse_duration")
+    @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
+    def test_custom_max_single_seconds(
+        self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
+        mock_check: MagicMock,
+        mock_parse: MagicMock,
+        mock_run: MagicMock,
+    ) -> None:
+        mock_run.return_value = ("out\n", "err\n")
+        mock_parse.return_value = 1.0
+        mock_parse_per.return_value = []
+        mock_check_per.return_value = []
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--max-single-seconds", "1.0"])
+        assert result.exit_code == 0
+        mock_check_per.assert_called_once_with([], 1.0)

tests/unit/test_cli.py

@@ -166,6 +166,13 @@ class TestToolsCommands:
         assert result.exit_code == 0
         mock_run.assert_called_once_with("devx.tools.generate_badges", [])
 
+    @patch("devx.cli._run_module")
+    def test_tools_generate_cliff_config(self, mock_run: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["tools", "generate-cliff-config"])
+        assert result.exit_code == 0
+        mock_run.assert_called_once_with("devx.tools.generate_cliff_config", [])
+
     @patch("devx.cli._run_module")
     def test_tools_install_checkmake(self, mock_run: MagicMock) -> None:
         runner = CliRunner()
@@ -218,6 +225,29 @@ class TestMoleculeCommands:
         mock_run.assert_called_once_with("devx.molecule.molecule_all", [])
 
 
+class TestNewCiCommands:
+    @patch("devx.cli._run_module")
+    def test_ci_distribute_files(self, mock_run: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["ci", "distribute-files", "--", "--pattern", "*.py"])
+        assert result.exit_code == 0
+        mock_run.assert_called_once_with("devx.ci.distribute_files", ["--pattern", "*.py"])
+
+    @patch("devx.cli._run_module")
+    def test_ci_merge_junit(self, mock_run: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["ci", "merge-junit", "--", "--output", "merged.xml"])
+        assert result.exit_code == 0
+        mock_run.assert_called_once_with("devx.ci.merge_junit", ["--output", "merged.xml"])
+
+    @patch("devx.cli._run_module")
+    def test_ci_integration_guard(self, mock_run: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["ci", "integration-guard", "--", "-v"])
+        assert result.exit_code == 0
+        mock_run.assert_called_once_with("devx.ci.integration_guard", ["-v"])
+
+
 class TestRunModule:
     @patch("importlib.import_module")
     def test_run_module_success(self, mock_import: MagicMock) -> None:

tests/unit/test_config.py

@@ -37,7 +37,7 @@ class TestConfigConstants:
         assert DEFAULT_PER_PAGE == 50
 
     def test_owner(self) -> None:
-        assert REPO_OWNER == "oblachno-oss"
+        assert REPO_OWNER == ""
 
     def test_task_prefix(self) -> None:
         assert TASK_PREFIX == "DEVX"

tests/unit/test_configure_repo.py

@@ -163,3 +163,37 @@ class TestMain:
         mock_client.ensure_branch_protection.assert_called_once()
         args = mock_client.ensure_branch_protection.call_args
         assert args[0][0] == "develop"
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "DEVX_REPO_NAME": "oblachno/infra"}, clear=True)
+    @patch("devx.tools.configure_repo.GiteaClient")
+    def test_main_parses_owner_repo_from_env(self, mock_client_cls: MagicMock) -> None:
+        """DEVX_REPO_NAME with 'owner/repo' format should be split."""
+        mock_client = MagicMock()
+        mock_client_cls.return_value = mock_client
+
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0
+        # Verify GiteaClient was constructed with parsed owner and repo (positional)
+        call_args = mock_client_cls.call_args
+        assert call_args[0][2] == "oblachno"  # owner is 3rd positional arg
+        assert call_args[0][3] == "infra"  # repo is 4th positional arg
+
+    @patch.dict(
+        "os.environ",
+        {"REPO_TOKEN": "tok", "DEVX_REPO_NAME": "infra", "DEVX_REPO_OWNER": "oblachno"},
+        clear=True,
+    )
+    @patch("devx.tools.configure_repo.REPO_OWNER", "oblachno")
+    @patch("devx.tools.configure_repo.GiteaClient")
+    def test_main_no_slash_when_owner_set_separately(self, mock_client_cls: MagicMock) -> None:
+        """When DEVX_REPO_OWNER is set, DEVX_REPO_NAME should not be split."""
+        mock_client = MagicMock()
+        mock_client_cls.return_value = mock_client
+
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0
+        call_args = mock_client_cls.call_args
+        assert call_args[0][2] == "oblachno"  # owner
+        assert call_args[0][3] == "infra"  # repo

tests/unit/test_distribute_files.py

@@ -0,0 +1,154 @@
+"""Unit tests for devx.ci.distribute_files."""
+
+from pathlib import Path
+
+import pytest
+from click.testing import CliRunner
+
+from devx.ci.distribute_files import (
+    DEFAULT_MAX_RUNNERS,
+    discover_files,
+    distribute,
+    files_for_runner,
+    main,
+)
+
+
+class TestDiscoverFiles:
+    def test_discovers_sorted(self, tmp_path: Path) -> None:
+        (tmp_path / "test_b.py").write_text("")
+        (tmp_path / "test_a.py").write_text("")
+        result = discover_files(str(tmp_path / "test_*.py"))
+        assert len(result) == 2
+        assert result[0].endswith("test_a.py")
+        assert result[1].endswith("test_b.py")
+
+    def test_no_matches(self, tmp_path: Path) -> None:
+        assert discover_files(str(tmp_path / "nonexistent-*.py")) == []
+
+
+class TestDistribute:
+    def test_even_split(self) -> None:
+        files = [f"test_{i}.py" for i in range(6)]
+        groups = distribute(files, 3)
+        assert len(groups) == 3
+        assert all(len(g) == 2 for g in groups)
+
+    def test_uneven_split(self) -> None:
+        files = [f"test_{i}.py" for i in range(5)]
+        groups = distribute(files, 3)
+        assert len(groups[0]) == 2
+        assert len(groups[1]) == 2
+        assert len(groups[2]) == 1
+
+    def test_more_runners_than_files(self) -> None:
+        files = ["test_a.py"]
+        groups = distribute(files, 5)
+        assert len(groups) == 5
+        assert len(groups[0]) == 1
+        assert all(len(g) == 0 for g in groups[1:])
+
+    def test_empty(self) -> None:
+        assert distribute([], 3) == [[], [], []]
+
+
+class TestFilesForRunner:
+    def test_returns_correct_subset(self) -> None:
+        files = [f"test_{i}.py" for i in range(6)]
+        assert len(files_for_runner(files, 0, 3)) == 2
+        assert len(files_for_runner(files, 1, 3)) == 2
+        assert len(files_for_runner(files, 2, 3)) == 2
+
+    def test_out_of_range_raises(self) -> None:
+        with pytest.raises(Exception, match="out of range"):
+            files_for_runner(["a.py"], 5, 3)
+
+
+class TestCli:
+    def test_no_runner_index_prints_groups(self, tmp_path: Path) -> None:
+        for i in range(3):
+            (tmp_path / f"test_{i}.py").write_text("")
+        runner = CliRunner()
+        result = runner.invoke(main, ["--pattern", str(tmp_path / "test_*.py"), "--max-runners", "3"])
+        assert result.exit_code == 0
+        assert "Runner 0:" in result.output
+        assert "Runner 1:" in result.output
+        assert "Runner 2:" in result.output
+
+    def test_runner_index_prints_assigned(self, tmp_path: Path) -> None:
+        for i in range(3):
+            (tmp_path / f"test_{i}.py").write_text("")
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "test_*.py"), "--runner-index", "1", "--max-runners", "3"],
+        )
+        assert result.exit_code == 0
+        assert "test_0.py" in result.output
+
+    def test_github_env_writes_files(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        gh_file = tmp_path / "env.txt"
+        monkeypatch.setenv("GITHUB_ENV", str(gh_file))
+        for i in range(2):
+            (tmp_path / f"test_{i}.py").write_text("")
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "test_*.py"), "--runner-index", "1", "--max-runners", "2", "--github-env"],
+        )
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "ASSIGNED_FILES=" in content
+        assert "SKIP=false" in content
+
+    def test_skip_if_excess(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        gh_file = tmp_path / "env.txt"
+        monkeypatch.setenv("GITHUB_ENV", str(gh_file))
+        (tmp_path / "test.py").write_text("")
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            [
+                "--pattern",
+                str(tmp_path / "test_*.py"),
+                "--runner-index",
+                "5",
+                "--max-runners",
+                "2",
+                "--github-env",
+                "--skip-if-excess",
+            ],
+        )
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "ASSIGNED_FILES=\n" in content
+        assert "SKIP=true" in content
+
+    def test_runner_index_zero_raises(self, tmp_path: Path) -> None:
+        (tmp_path / "test.py").write_text("")
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "test_*.py"), "--runner-index", "0", "--max-runners", "3"],
+        )
+        assert result.exit_code != 0
+
+    def test_no_env_var_raises(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("GITHUB_ENV", raising=False)
+        (tmp_path / "test.py").write_text("")
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "test_*.py"), "--runner-index", "1", "--max-runners", "3", "--github-env"],
+        )
+        assert result.exit_code != 0
+
+
+def test_default_max_runners() -> None:
+    assert DEFAULT_MAX_RUNNERS == 3
+
+
+def test_main_module_block() -> None:
+    import devx.ci.distribute_files as mod
+
+    assert hasattr(mod, "main")

tests/unit/test_distribute_molecule.py

@@ -8,13 +8,19 @@ import pytest
 from click.testing import CliRunner
 
 from devx.molecule.distribute_molecule import (
+    DEFAULT_ROLES_ROOT,
     MOLECULE_ROOT,
     PLATFORMS,
+    MultiRoleTestPair,
     TestPair,
+    build_multi_role_pairs,
     build_pairs,
     cli,
+    discover_multi_role_scenarios,
     discover_scenarios,
     distribute,
+    distribute_multi_role,
+    multi_role_pairs_for_runner,
     pairs_for_runner,
 )
 
@@ -157,10 +163,7 @@ class TestCli:
             runner = CliRunner()
             result = runner.invoke(cli, ["--list-platforms"])
         assert result.exit_code == 0
-        assert "ubuntu-2204" in result.output
-        assert "ubuntu-2404" in result.output
-        assert "debian-12" in result.output
-        assert "archlinux" in result.output
+        assert "ubuntu-2604" in result.output
 
     def test_no_runner_index_prints_all_groups(self, tmp_path: Path) -> None:
         from click.testing import CliRunner
@@ -192,7 +195,7 @@ class TestCli:
             assert result.exit_code == 0
             # Output should contain encoded pairs with platform info
             assert "alpha|" in result.output
-            assert "ubuntu-2204" in result.output
+            assert "ubuntu-2604" in result.output
 
 
 class TestGithubEnv:
@@ -259,3 +262,218 @@ def test_main_module_block() -> None:
     namespace = dict(dm.__dict__)
     exec(compile(source, dm.__file__, "exec"), namespace)
     assert callable(namespace["cli"])
+
+
+class TestDiscoverMultiRole:
+    def test_discovers_role_scenario_pairs(self, tmp_path: Path) -> None:
+        roles = tmp_path / "roles"
+        for scenario in ["default", "binary"]:
+            (roles / "gitea-runner" / "molecule" / scenario).mkdir(parents=True)
+        (roles / "gitea-runner" / "molecule" / "common").mkdir(parents=True)
+        (roles / "gitea-runner" / "molecule" / "_shared").mkdir(parents=True)
+        (roles / "docker-base" / "molecule" / "default").mkdir(parents=True)
+        (roles / "no-molecule").mkdir(parents=True)
+        result = discover_multi_role_scenarios(roles)
+        assert ("docker-base", "default") in result
+        assert ("gitea-runner", "default") in result
+        assert ("gitea-runner", "binary") in result
+        assert ("gitea-runner", "common") not in result
+        assert ("gitea-runner", "_shared") not in result
+        assert len(result) == 3
+
+    def test_raises_when_dir_missing(self, tmp_path: Path) -> None:
+        with pytest.raises(click.ClickException) as exc:
+            discover_multi_role_scenarios(tmp_path / "nonexistent")
+        assert "not found" in str(exc.value)
+
+    def test_default_roles_root_raises_when_missing(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """Calling with no args uses DEFAULT_ROLES_ROOT which doesn't exist in tests."""
+        with pytest.raises(click.ClickException):
+            discover_multi_role_scenarios()
+
+    def test_default_roles_root_constant(self) -> None:
+        assert Path("ansible/roles") == DEFAULT_ROLES_ROOT
+
+
+class TestMultiRoleTestPair:
+    def test_encode_roundtrip(self) -> None:
+        pair = MultiRoleTestPair(
+            "docker-base", "default", {"name": "ubuntu-2204", "image": "ubuntu:22.04", "command": ""}
+        )
+        encoded = pair.encode()
+        assert encoded == "docker-base|default|ubuntu-2204|ubuntu:22.04|"
+        decoded = MultiRoleTestPair.decode(encoded)
+        assert decoded.role == "docker-base"
+        assert decoded.scenario == "default"
+        assert decoded.platform["name"] == "ubuntu-2204"
+
+
+class TestBuildMultiRolePairs:
+    def test_cross_product(self) -> None:
+        role_scenarios = [("role-a", "default"), ("role-b", "binary")]
+        platforms = [{"name": "p1", "image": "i1", "command": ""}]
+        pairs = build_multi_role_pairs(role_scenarios, platforms)
+        assert len(pairs) == 2
+        assert pairs[0].role == "role-a"
+        assert pairs[1].role == "role-b"
+
+    def test_default_platforms(self) -> None:
+        pairs = build_multi_role_pairs([("r", "s")])
+        assert len(pairs) == len(PLATFORMS)
+
+
+class TestDistributeMultiRole:
+    def test_even_split(self) -> None:
+        pairs = [MultiRoleTestPair(f"r{i}", "s", {"name": "p", "image": "i", "command": ""}) for i in range(6)]
+        groups = distribute_multi_role(pairs, 3)
+        assert all(len(g) == 2 for g in groups)
+
+    def test_out_of_range_raises(self) -> None:
+        pairs = [MultiRoleTestPair("r", "s", {"name": "p", "image": "i", "command": ""})]
+        with pytest.raises(click.ClickException):
+            multi_role_pairs_for_runner(pairs, 5, 3)
+
+
+class TestCliMultiRole:
+    def test_roles_root_list(self, tmp_path: Path) -> None:
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        (roles / "role-b" / "molecule" / "binary").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--roles-root", str(roles), "--list"])
+        assert result.exit_code == 0
+        assert "role-a|default" in result.output
+        assert "role-b|binary" in result.output
+
+    def test_roles_root_runner_index(self, tmp_path: Path) -> None:
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--roles-root", str(roles), "--runner-index", "1", "--max-runners", "3"])
+        assert result.exit_code == 0
+        assert "role-a|default|" in result.output
+
+    def test_roles_root_github_env(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        gh_file = tmp_path / "env.txt"
+        monkeypatch.setenv("GITHUB_ENV", str(gh_file))
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            ["--roles-root", str(roles), "--runner-index", "1", "--max-runners", "3", "--github-env"],
+        )
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "TEST_PAIRS=" in content
+        assert "SKIP=false" in content
+
+    def test_roles_root_skip_if_excess(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        gh_file = tmp_path / "env.txt"
+        monkeypatch.setenv("GITHUB_ENV", str(gh_file))
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            [
+                "--roles-root",
+                str(roles),
+                "--runner-index",
+                "5",
+                "--max-runners",
+                "2",
+                "--github-env",
+                "--skip-if-excess",
+            ],
+        )
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "SKIP=true" in content
+
+    def test_molecule_root_option(self, tmp_path: Path) -> None:
+        root = tmp_path / "custom-molecule"
+        (root / "alpha").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--molecule-root", str(root), "--list"])
+        assert result.exit_code == 0
+        assert "alpha" in result.output
+
+    def test_roles_root_list_platforms(self, tmp_path: Path) -> None:
+        """--roles-root --list-platforms prints platforms."""
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--roles-root", str(roles), "--list-platforms"])
+        assert result.exit_code == 0
+        assert "ubuntu-2604" in result.output
+
+    def test_roles_root_no_runner_index_prints_groups(self, tmp_path: Path) -> None:
+        """--roles-root without --runner-index prints all groups."""
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        (roles / "role-b" / "molecule" / "binary").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--roles-root", str(roles), "--max-runners", "2"])
+        assert result.exit_code == 0
+        assert "Runner 0:" in result.output
+        assert "Runner 1:" in result.output
+
+    def test_platforms_file_overrides_default(self, tmp_path: Path) -> None:
+        """--platforms-file loads custom platforms from JSON."""
+        import json
+
+        from click.testing import CliRunner
+
+        from devx.molecule.distribute_molecule import cli
+
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        platforms_file = tmp_path / "platforms.json"
+        custom = [{"name": "custom-os", "image": "custom:latest", "command": "sleep infinity"}]
+        platforms_file.write_text(json.dumps(custom))
+        runner = CliRunner()
+        result = runner.invoke(
+            cli, ["--roles-root", str(roles), "--platforms-file", str(platforms_file), "--list-platforms"]
+        )
+        assert result.exit_code == 0
+        assert "custom-os" in result.output
+        assert "custom:latest" in result.output
+
+    def test_roles_root_skips_non_dir_role(self, tmp_path: Path) -> None:
+        """Non-directory entries in roles root are skipped."""
+        roles = tmp_path / "roles"
+        roles.mkdir(parents=True)
+        (roles / "README.md").write_text("not a role")
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        result = discover_multi_role_scenarios(roles)
+        assert ("role-a", "default") in result
+        assert len(result) == 1
+
+    def test_roles_root_skips_non_dir_scenario(self, tmp_path: Path) -> None:
+        """Non-directory entries in molecule dir are skipped."""
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule").mkdir(parents=True)
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        (roles / "role-a" / "molecule" / "file.txt").write_text("not a scenario")
+        result = discover_multi_role_scenarios(roles)
+        assert ("role-a", "default") in result
+        assert len(result) == 1
+
+    def test_roles_root_skips_role_without_molecule(self, tmp_path: Path) -> None:
+        """Roles without a molecule/ directory are skipped."""
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        (roles / "no-molecule").mkdir(parents=True)
+        result = discover_multi_role_scenarios(roles)
+        assert ("role-a", "default") in result
+        assert len(result) == 1
+
+    def test_roles_root_runner_index_zero_raises(self, tmp_path: Path) -> None:
+        """--roles-root --runner-index 0 should raise."""
+        roles = tmp_path / "roles"
+        (roles / "role-a" / "molecule" / "default").mkdir(parents=True)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--roles-root", str(roles), "--runner-index", "0", "--max-runners", "3"])
+        assert result.exit_code != 0
+        assert "out of range" in result.output

tests/unit/test_generate_badges.py

@@ -1,4 +1,4 @@
-"""Unit tests for scripts/generate_badges.py."""
+"""Unit tests for devx/tools/generate_badges.py."""
 
 from pathlib import Path
 from unittest.mock import MagicMock, patch
@@ -8,7 +8,13 @@ from click.testing import CliRunner
 from devx.tools.generate_badges import (
     COLOR_HEX,
     cli,
+    collect_coverage_and_tests,
+    collect_doc_coverage,
+    collect_quality,
     coverage_color,
+    detect_coverage_target,
+    detect_package_name,
+    detect_testpaths,
     doc_coverage_color,
     extract_coverage,
     extract_doc_coverage,
@@ -17,10 +23,107 @@ from devx.tools.generate_badges import (
     make_badge,
     read_version,
     render_svg,
+    resolve_repo_root,
     run_command,
 )
 
 
+class TestResolveRepoRoot:
+    def test_uses_github_workspace_when_set(self, tmp_path: Path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+        monkeypatch.setenv("GITHUB_WORKSPACE", str(tmp_path))
+        assert resolve_repo_root() == tmp_path
+
+    def test_falls_back_to_cwd_when_no_workspace(self, tmp_path: Path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+        monkeypatch.delenv("GITHUB_WORKSPACE", raising=False)
+        monkeypatch.chdir(tmp_path)
+        assert resolve_repo_root() == tmp_path
+
+    def test_falls_back_to_cwd_when_workspace_invalid(self, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+        monkeypatch.setenv("GITHUB_WORKSPACE", "/nonexistent/path")
+        result = resolve_repo_root()
+        assert result == Path.cwd()
+
+
+class TestDetectPackageName:
+    def test_detects_package_with_init(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src"
+        pkg = src / "mypkg"
+        pkg.mkdir(parents=True)
+        (pkg / "__init__.py").write_text('__version__ = "1.0.0"\n')
+        assert detect_package_name(tmp_path) == "mypkg"
+
+    def test_returns_none_when_no_src(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        assert detect_package_name(tmp_path) is None
+
+    def test_returns_none_when_no_init(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src"
+        pkg = src / "mypkg"
+        pkg.mkdir(parents=True)
+        # No __init__.py
+        assert detect_package_name(tmp_path) is None
+
+    def test_picks_first_package_alphabetically(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src"
+        for name in ["zpkg", "apkg"]:
+            d = src / name
+            d.mkdir(parents=True)
+            (d / "__init__.py").write_text("")
+        assert detect_package_name(tmp_path) == "apkg"
+
+    def test_skips_non_dir_entries(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src"
+        src.mkdir(parents=True)
+        (src / "README.md").write_text("not a package")
+        pkg = src / "mypkg"
+        pkg.mkdir()
+        (pkg / "__init__.py").write_text("")
+        assert detect_package_name(tmp_path) == "mypkg"
+
+
+class TestDetectCoverageTarget:
+    def test_parses_from_pyproject(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "pyproject.toml").write_text(
+            '[tool.pytest.ini_options]\naddopts = "--cov=src/devx --cov-report=term-missing"\n'
+        )
+        assert detect_coverage_target(tmp_path) == "src/devx"
+
+    def test_falls_back_to_src_package(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src"
+        pkg = src / "mypkg"
+        pkg.mkdir(parents=True)
+        (pkg / "__init__.py").write_text('__version__ = "1.0"\n')
+        assert detect_coverage_target(tmp_path) == "src/mypkg"
+
+    def test_returns_none_when_no_package(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        assert detect_coverage_target(tmp_path) is None
+
+
+class TestDetectTestpaths:
+    def test_parses_from_pyproject(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "scripts" / "tests").mkdir(parents=True)
+        (tmp_path / "tests" / "unit").mkdir(parents=True)
+        (tmp_path / "pyproject.toml").write_text(
+            '[tool.pytest.ini_options]\ntestpaths = ["scripts/tests", "tests/unit"]\n'
+        )
+        assert detect_testpaths(tmp_path) == ["scripts/tests", "tests/unit"]
+
+    def test_filters_nonexistent_paths(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "tests").mkdir()
+        (tmp_path / "pyproject.toml").write_text('[tool.pytest.ini_options]\ntestpaths = ["tests", "nonexistent"]\n')
+        assert detect_testpaths(tmp_path) == ["tests"]
+
+    def test_falls_back_to_tests_dir(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "tests").mkdir()
+        assert detect_testpaths(tmp_path) == ["tests"]
+
+    def test_returns_empty_when_no_tests_dir(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        assert detect_testpaths(tmp_path) == []
+
+    def test_returns_empty_when_pyproject_has_no_testpaths(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "pyproject.toml").write_text("[tool.pytest.ini_options]\naddopts = '-ra'\n")
+        assert detect_testpaths(tmp_path) == []
+
+
 class TestRunCommand:
     @patch("devx.tools.generate_badges.subprocess.run")
     def test_returns_returncode_stdout_stderr(self, mock_run: MagicMock) -> None:
@@ -157,100 +260,122 @@ class TestDocCoverageColor:
 
 
 class TestReadVersion:
-    @patch("devx.tools.generate_badges._find_package_init")
-    def test_reads_version_from_init(self, mock_find: MagicMock) -> None:
-        mock_init = MagicMock()
-        mock_init.read_text.return_value = '__version__ = "0.5.0"\n'
-        mock_find.return_value = mock_init
-        assert read_version() == "0.5.0"
+    def test_reads_version_from_init(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src" / "mypkg"
+        src.mkdir(parents=True)
+        (src / "__init__.py").write_text('__version__ = "0.5.0"\n')
+        assert read_version(tmp_path) == "0.5.0"
 
-    @patch("devx.tools.generate_badges._find_package_init")
-    def test_returns_unknown_when_no_version(self, mock_find: MagicMock) -> None:
-        mock_init = MagicMock()
-        mock_init.read_text.return_value = "no version here\n"
-        mock_find.return_value = mock_init
-        assert read_version() == "unknown"
+    def test_returns_unknown_when_no_version(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        src = tmp_path / "src" / "mypkg"
+        src.mkdir(parents=True)
+        (src / "__init__.py").write_text("no version here\n")
+        assert read_version(tmp_path) == "unknown"
 
-    @patch("devx.tools.generate_badges._find_package_init", return_value=None)
-    def test_returns_unknown_when_no_init(self, mock_find: MagicMock) -> None:
-        assert read_version() == "unknown"
+    def test_returns_unknown_when_no_package(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        assert read_version(tmp_path) == "unknown"
+
+    @patch("devx.tools.generate_badges.detect_package_name", return_value="mypkg")
+    def test_returns_unknown_when_init_missing(self, mock_pkg: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        # Package detected but __init__.py doesn't exist (edge case)
+        assert read_version(tmp_path) == "unknown"
 
 
-class TestFindPackageInit:
-    @patch("devx.tools.generate_badges.REPO_ROOT")
-    def test_no_src_dir(self, mock_root: MagicMock) -> None:
-        """Returns None when src/ directory doesn't exist."""
-        from devx.tools.generate_badges import _find_package_init
+class TestCollectCoverageAndTests:
+    @patch("devx.tools.generate_badges.run_command")
+    @patch("devx.tools.generate_badges.detect_testpaths", return_value=["tests"])
+    @patch("devx.tools.generate_badges.detect_coverage_target", return_value="src/devx")
+    def test_extracts_coverage_and_tests(
+        self, mock_target: MagicMock, mock_testpaths: MagicMock, mock_run: MagicMock, tmp_path: Path
+    ) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (0, "1018 passed in 4.23s\nTOTAL 3546 0 100%", "")
+        cov, tests = collect_coverage_and_tests(tmp_path)
+        assert cov["message"] == "100%"
+        assert tests["message"] == "1018 passing"
 
-        mock_src = MagicMock()
-        mock_src.exists.return_value = False
-        mock_root.__truediv__ = MagicMock(return_value=mock_src)
-        assert _find_package_init() is None
+    @patch("devx.tools.generate_badges.run_command")
+    @patch("devx.tools.generate_badges.detect_testpaths", return_value=["tests"])
+    @patch("devx.tools.generate_badges.detect_coverage_target", return_value="src/devx")
+    def test_returns_unknown_when_no_match(
+        self, mock_target: MagicMock, mock_testpaths: MagicMock, mock_run: MagicMock, tmp_path: Path
+    ) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (1, "garbled output", "some error")
+        cov, tests = collect_coverage_and_tests(tmp_path)
+        assert cov["message"] == "unknown"
+        assert tests["message"] == "unknown"
 
-    @patch("devx.tools.generate_badges.REPO_ROOT")
-    def test_no_version_in_init_files(self, mock_root: MagicMock, tmp_path: Path) -> None:
-        """Returns None when no __init__.py has __version__."""
-        from devx.tools.generate_badges import _find_package_init
+    @patch("devx.tools.generate_badges.detect_coverage_target", return_value=None)
+    def test_returns_lightgrey_when_no_target(self, mock_target: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        cov, tests = collect_coverage_and_tests(tmp_path)
+        assert cov["message"] == "unknown"
+        assert cov["color"] == "lightgrey"
+        assert tests["message"] == "unknown"
+        assert tests["color"] == "lightgrey"
 
-        src_dir = tmp_path / "src"
-        src_dir.mkdir()
-        (src_dir / "__init__.py").write_text("# no version here\n")
-        mock_root.__truediv__ = MagicMock(return_value=src_dir)
-        assert _find_package_init() is None
 
-    @patch("devx.tools.generate_badges.REPO_ROOT")
-    def test_finds_init_with_version(self, mock_root: MagicMock, tmp_path: Path) -> None:
-        """Returns the __init__.py that has __version__."""
-        from devx.tools.generate_badges import _find_package_init
+class TestCollectDocCoverage:
+    @patch("devx.tools.generate_badges.run_command")
+    def test_extracts_doc_coverage(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (0, "Doc coverage: 20/20 (100%)", "")
+        badge = collect_doc_coverage(tmp_path)
+        assert badge["message"] == "100%"
 
-        src_dir = tmp_path / "src"
-        pkg_dir = src_dir / "mypkg"
-        pkg_dir.mkdir(parents=True)
-        (src_dir / "__init__.py").write_text("# no version\n")
-        (pkg_dir / "__init__.py").write_text('__version__ = "1.0.0"\n')
-        mock_root.__truediv__ = MagicMock(return_value=src_dir)
-        result = _find_package_init()
-        assert result is not None
-        assert "__version__" in result.read_text()
+    @patch("devx.tools.generate_badges.run_command")
+    def test_returns_unknown_when_no_match(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (1, "no doc coverage", "error")
+        badge = collect_doc_coverage(tmp_path)
+        assert badge["message"] == "unknown"
 
-    @patch("devx.tools.generate_badges.REPO_ROOT")
-    def test_handles_oserror(self, mock_root: MagicMock, tmp_path: Path) -> None:
-        """Handles OSError when reading init files."""
-        from devx.tools.generate_badges import _find_package_init
 
-        src_dir = tmp_path / "src"
-        src_dir.mkdir()
-        init_file = src_dir / "__init__.py"
-        init_file.write_text('__version__ = "1.0.0"\n')
-        mock_root.__truediv__ = MagicMock(return_value=src_dir)
-        # Patch Path.read_text to raise OSError
-        with patch.object(Path, "read_text", side_effect=OSError("permission denied")):
-            result = _find_package_init()
-        assert result is None
+class TestCollectQuality:
+    @patch("devx.tools.generate_badges.run_command")
+    def test_all_pass_returns_a(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (0, "", "")
+        badge = collect_quality(tmp_path)
+        assert badge["message"] == "A"
+        assert badge["color"] == "brightgreen"
+
+    @patch("devx.tools.generate_badges.run_command")
+    def test_lint_failure_returns_f(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (1, "", "some error")
+        badge = collect_quality(tmp_path)
+        assert badge["message"] == "F"
+        assert badge["color"] == "red"
+
+    @patch("devx.tools.generate_badges.run_command")
+    def test_tool_not_installed_counts_as_pass(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        mock_run.return_value = (1, "", "No module named ruff")
+        badge = collect_quality(tmp_path)
+        assert badge["message"] == "A"
 
 
 class TestGenerateBadges:
-    @patch("devx.tools.generate_badges.run_command")
+    @patch("devx.tools.generate_badges.collect_quality")
+    @patch("devx.tools.generate_badges.collect_doc_coverage")
+    @patch("devx.tools.generate_badges.collect_coverage_and_tests")
     @patch("devx.tools.generate_badges.read_version", return_value="0.5.0")
-    @patch("devx.tools.generate_badges.extract_coverage", return_value=100.0)
-    @patch("devx.tools.generate_badges.extract_test_count", return_value=573)
-    @patch("devx.tools.generate_badges.extract_doc_coverage", return_value=100)
+    @patch("devx.tools.generate_badges.detect_package_name", return_value="devx")
     def test_generates_all_badge_files(
         self,
-        mock_doc_cov: MagicMock,
-        mock_test_count: MagicMock,
-        mock_cov: MagicMock,
+        mock_pkg: MagicMock,
         mock_version: MagicMock,
-        mock_run: MagicMock,
+        mock_cov_tests: MagicMock,
+        mock_doc: MagicMock,
+        mock_quality: MagicMock,
         tmp_path: Path,
-    ) -> None:
-        mock_run.return_value = (0, "output", "")
-        badges = generate_badges(tmp_path)
+    ) -> None:  # type: ignore[no-untyped-def]
+        mock_cov_tests.return_value = (
+            make_badge("coverage", "100%", "brightgreen"),
+            make_badge("tests", "573 passing", "brightgreen"),
+        )
+        mock_doc.return_value = make_badge("docs", "100%", "brightgreen")
+        mock_quality.return_value = make_badge("code quality", "A", "brightgreen")
+
+        badges = generate_badges(tmp_path, repo_root=tmp_path)
 
         expected = {"coverage", "tests", "docs", "quality", "version", "python"}
         assert set(badges.keys()) == expected
 
-        # Verify SVG files were written
         for name in expected:
             svg_file = tmp_path / f"{name}.svg"
             assert svg_file.exists()
@@ -258,78 +383,10 @@ class TestGenerateBadges:
             assert content.startswith("<svg")
             assert "</svg>" in content
 
-    @patch("devx.tools.generate_badges.run_command")
-    @patch("devx.tools.generate_badges.read_version", return_value="0.5.0")
-    @patch("devx.tools.generate_badges.extract_coverage", return_value=100.0)
-    @patch("devx.tools.generate_badges.extract_test_count", return_value=573)
-    @patch("devx.tools.generate_badges.extract_doc_coverage", return_value=100)
-    def test_quality_badge_pass_when_all_lint_passes(
-        self,
-        mock_doc_cov: MagicMock,
-        mock_test_count: MagicMock,
-        mock_cov: MagicMock,
-        mock_version: MagicMock,
-        mock_run: MagicMock,
-        tmp_path: Path,
-    ) -> None:
-        mock_run.return_value = (0, "output", "")
-        badges = generate_badges(tmp_path)
-        assert badges["quality"]["message"] == "A"
-        assert badges["quality"]["color"] == "brightgreen"
-
-    @patch("devx.tools.generate_badges.run_command")
-    @patch("devx.tools.generate_badges.read_version", return_value="0.5.0")
-    @patch("devx.tools.generate_badges.extract_coverage", return_value=100.0)
-    @patch("devx.tools.generate_badges.extract_test_count", return_value=573)
-    @patch("devx.tools.generate_badges.extract_doc_coverage", return_value=100)
-    def test_quality_badge_fails_when_lint_fails(
-        self,
-        mock_doc_cov: MagicMock,
-        mock_test_count: MagicMock,
-        mock_cov: MagicMock,
-        mock_version: MagicMock,
-        mock_run: MagicMock,
-        tmp_path: Path,
-    ) -> None:
-        mock_run.side_effect = [
-            (0, "output", ""),
-            (0, "output", ""),
-            (1, "error", ""),
-            (0, "output", ""),
-            (0, "output", ""),
-            (0, "output", ""),
-        ]
-        badges = generate_badges(tmp_path)
-        assert badges["quality"]["message"] == "F"
-        assert badges["quality"]["color"] == "red"
-
-    @patch("devx.tools.generate_badges.run_command")
-    @patch("devx.tools.generate_badges.read_version", return_value="0.5.0")
-    @patch("devx.tools.generate_badges.extract_coverage", return_value=None)
-    @patch("devx.tools.generate_badges.extract_test_count", return_value=None)
-    @patch("devx.tools.generate_badges.extract_doc_coverage", return_value=None)
-    def test_badges_show_unknown_when_extraction_fails(
-        self,
-        mock_doc_cov: MagicMock,
-        mock_test_count: MagicMock,
-        mock_cov: MagicMock,
-        mock_version: MagicMock,
-        mock_run: MagicMock,
-        tmp_path: Path,
-    ) -> None:
-        mock_run.return_value = (1, "garbled output", "")
-        badges = generate_badges(tmp_path)
-        assert badges["coverage"]["message"] == "unknown"
-        assert badges["coverage"]["color"] == "red"
-        assert badges["tests"]["message"] == "unknown"
-        assert badges["tests"]["color"] == "red"
-        assert badges["docs"]["message"] == "unknown"
-        assert badges["docs"]["color"] == "red"
-
 
 class TestCli:
     @patch("devx.tools.generate_badges.generate_badges")
-    def test_cli_generates_badges(self, mock_gen: MagicMock, tmp_path: Path) -> None:
+    def test_cli_generates_badges(self, mock_gen: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
         mock_gen.return_value = {
             "coverage": make_badge("coverage", "100%", "brightgreen"),
             "tests": make_badge("tests", "573 passing", "brightgreen"),
@@ -339,7 +396,6 @@ class TestCli:
         assert result.exit_code == 0
         assert "Generating badges" in result.output
         assert "Generated 2 badges" in result.output
-        mock_gen.assert_called_once_with(tmp_path)
 
 
 def test_main_module_block() -> None:

tests/unit/test_generate_cliff_config.py

@@ -0,0 +1,124 @@
+"""Tests for devx.tools.generate_cliff_config."""
+
+from __future__ import annotations
+
+import tomllib
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+from click.testing import CliRunner
+
+from devx.tools.generate_cliff_config import main
+
+
+class TestGenerateCliffConfig:
+    """Tests for the generate_cliff_config tool."""
+
+    @pytest.fixture
+    def runner(self) -> CliRunner:
+        return CliRunner()
+
+    def test_generate_to_new_file(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Generate cliff.toml to a new file."""
+        output = tmp_path / "cliff.toml"
+        result = runner.invoke(main, ["--prefix", "GRM", "--output", str(output)])
+        assert result.exit_code == 0
+        assert output.exists()
+        content = output.read_text()
+        assert "git-cliff configuration for GRM" in content
+        assert 'pattern = "^GRM-\\\\d+:\\\\s+"' in content
+
+    def test_generate_with_default_prefix(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Generate with default prefix (DEVX_TASK_PREFIX or 'DEVX')."""
+        output = tmp_path / "cliff.toml"
+        with patch("devx.tools.generate_cliff_config.TASK_PREFIX", "DEVX"):
+            result = runner.invoke(main, ["--output", str(output)])
+        assert result.exit_code == 0
+        content = output.read_text()
+        assert "git-cliff configuration for DEVX" in content
+
+    def test_existing_file_without_force(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Refuse to overwrite existing file without --force."""
+        output = tmp_path / "cliff.toml"
+        output.write_text("# existing")
+        result = runner.invoke(main, ["--prefix", "GRM", "--output", str(output)])
+        assert result.exit_code != 0
+        assert "already exists" in result.output
+        assert output.read_text() == "# existing"
+
+    def test_existing_file_with_force(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Overwrite existing file with --force."""
+        output = tmp_path / "cliff.toml"
+        output.write_text("# existing")
+        result = runner.invoke(main, ["--prefix", "GRM", "--output", str(output), "--force"])
+        assert result.exit_code == 0
+        content = output.read_text()
+        assert "git-cliff configuration for GRM" in content
+        assert "# existing" not in content
+
+    def test_generated_config_is_valid_toml(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Generated config must be valid TOML."""
+        output = tmp_path / "cliff.toml"
+        result = runner.invoke(main, ["--prefix", "GRM", "--output", str(output)])
+        assert result.exit_code == 0
+        with open(output, "rb") as f:
+            data = tomllib.load(f)
+        assert "changelog" in data
+        assert "git" in data
+        assert "bump" in data
+        assert data["bump"]["initial_tag"] == "0.1.0"
+        assert data["bump"]["features_always_bump_minor"] is True
+
+    def test_generated_config_has_correct_preprocessor(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Preprocessor pattern must match the given prefix."""
+        output = tmp_path / "cliff.toml"
+        result = runner.invoke(main, ["--prefix", "INFRA", "--output", str(output)])
+        assert result.exit_code == 0
+        with open(output, "rb") as f:
+            data = tomllib.load(f)
+        preprocessors = data["git"]["commit_preprocessors"]
+        assert len(preprocessors) == 1
+        pattern = preprocessors[0]["pattern"]
+        assert "INFRA" in pattern
+
+    def test_generated_config_has_commit_parsers(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Generated config must have all standard commit parsers."""
+        output = tmp_path / "cliff.toml"
+        result = runner.invoke(main, ["--prefix", "GRM", "--output", str(output)])
+        assert result.exit_code == 0
+        with open(output, "rb") as f:
+            data = tomllib.load(f)
+        parsers = data["git"]["commit_parsers"]
+        # Should have feat, fix, perf, refactor, doc, test, style, chore, ci, release, security, revert, catch-all
+        messages = [p["message"] for p in parsers if "message" in p]
+        assert "^feat" in messages
+        assert "^fix" in messages
+        assert "^perf" in messages
+        assert "^refactor" in messages
+        assert "^release:" in messages
+        assert "^revert" in messages
+        assert ".*" in messages  # catch-all
+
+    def test_default_output_path(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Default output path is cliff.toml in current directory."""
+        output = tmp_path / "cliff.toml"
+        # Change to tmp_path so default cliff.toml is created there
+        import os
+
+        old_cwd = os.getcwd()
+        os.chdir(tmp_path)
+        try:
+            result = runner.invoke(main, ["--prefix", "GRM"])
+            assert result.exit_code == 0
+            assert output.exists()
+        finally:
+            os.chdir(old_cwd)
+
+    def test_success_message(self, runner: CliRunner, tmp_path: Path) -> None:
+        """Success message includes file and prefix."""
+        output = tmp_path / "cliff.toml"
+        result = runner.invoke(main, ["--prefix", "GRM", "--output", str(output)])
+        assert result.exit_code == 0
+        assert "Generated" in result.output
+        assert "GRM" in result.output

tests/unit/test_integration_guard.py

@@ -0,0 +1,311 @@
+"""Unit tests for devx.ci.integration_guard."""
+
+from __future__ import annotations
+
+import os
+import subprocess  # nosec B404
+import time
+from unittest.mock import MagicMock, patch
+
+from click.testing import CliRunner
+
+from devx.ci.integration_guard import cli
+
+
+class TestCli:
+    def test_all_pass(self) -> None:
+        with (
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "tests/integration/test_foo.py"])
+            assert result.exit_code == 0
+            assert "Integration tests passed" in result.output
+
+    def test_failure_exits_nonzero(self) -> None:
+        with (
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 1
+            proc.returncode = 1
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "tests/integration/test_foo.py"])
+            assert result.exit_code == 1
+            assert "failed" in result.output
+
+    def test_junit_output_passed_to_pytest(self) -> None:
+        with (
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(
+                cli,
+                ["--junit-output", "junit-results/runner-1.xml", "--", "test_foo.py"],
+            )
+            assert result.exit_code == 0
+            call_args = mock_popen.call_args[0][0]
+            assert "--junitxml" in call_args
+            assert "junit-results/runner-1.xml" in call_args
+
+    def test_pytest_args_passed_through(self) -> None:
+        with (
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(
+                cli,
+                ["--", "-x", "-v", "--tb=short", "test_a.py", "test_b.py"],
+            )
+            assert result.exit_code == 0
+            call_args = mock_popen.call_args[0][0]
+            assert "-x" in call_args
+            assert "-v" in call_args
+            assert "test_a.py" in call_args
+            assert "test_b.py" in call_args
+
+    def test_keyboard_interrupt_kills_process(self) -> None:
+        with (
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep", side_effect=KeyboardInterrupt),
+            patch("os.killpg") as mock_killpg,
+            patch("os.getpgid") as mock_getpgid,
+        ):
+            mock_getpgid.return_value = 123
+            proc = MagicMock()
+            proc.poll.return_value = None
+            proc.wait.return_value = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 1
+            mock_killpg.assert_called()
+
+    def test_exits_when_other_runner_fails(self) -> None:
+        real_sleep = time.sleep
+        call_count = [0]
+
+        def get_jobs_side_effect(*args, **kwargs):
+            call_count[0] += 1
+            if call_count[0] < 2:
+                return [{"name": "integration-tests (1)", "conclusion": "running"}]
+            return [
+                {"name": "integration-tests (0)", "conclusion": "running"},
+                {"name": "integration-tests (1)", "conclusion": "failure"},
+            ]
+
+        with (
+            patch.dict(
+                os.environ,
+                {
+                    "GITEA_URL": "https://gitea.example",
+                    "REPO_TOKEN": "token",
+                    "RUN_ID": "123",
+                    "JOB_NAME": "integration-tests",
+                    "MATRIX_INDEX": "0",
+                    "GITEA_REPOSITORY": "oblachno-oss/infra",
+                    "PATH": os.environ.get("PATH", ""),
+                },
+                clear=True,
+            ),
+            patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
+            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("os.killpg") as mock_killpg,
+            patch("os.getpgid") as mock_getpgid,
+            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+        ):
+            mock_getpgid.return_value = 123
+            proc = MagicMock()
+            proc.poll.return_value = None
+            proc.wait.return_value = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 1
+            mock_killpg.assert_called()
+            assert "cancelled" in result.output.lower()
+
+    def test_process_lookup_error_suppressed(self) -> None:
+        real_sleep = time.sleep
+        call_count = [0]
+
+        def get_jobs_side_effect(*args, **kwargs):
+            call_count[0] += 1
+            if call_count[0] < 2:
+                return [{"name": "integration-tests (1)", "conclusion": "running"}]
+            return [
+                {"name": "integration-tests (0)", "conclusion": "running"},
+                {"name": "integration-tests (1)", "conclusion": "failure"},
+            ]
+
+        with (
+            patch.dict(
+                os.environ,
+                {
+                    "GITEA_URL": "https://gitea.example",
+                    "REPO_TOKEN": "token",
+                    "RUN_ID": "123",
+                    "JOB_NAME": "integration-tests",
+                    "MATRIX_INDEX": "0",
+                    "GITEA_REPOSITORY": "oblachno-oss/infra",
+                    "PATH": os.environ.get("PATH", ""),
+                },
+                clear=True,
+            ),
+            patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
+            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("os.killpg", side_effect=ProcessLookupError("no such process")),
+            patch("os.getpgid") as mock_getpgid,
+            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+        ):
+            mock_getpgid.return_value = 123
+            proc = MagicMock()
+            proc.poll.return_value = None
+            proc.wait.return_value = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 1
+
+    def test_timeout_expired_kills_with_sigkill(self) -> None:
+        real_sleep = time.sleep
+        call_count = [0]
+
+        def get_jobs_side_effect(*args, **kwargs):
+            call_count[0] += 1
+            if call_count[0] < 2:
+                return [{"name": "integration-tests (1)", "conclusion": "running"}]
+            return [
+                {"name": "integration-tests (0)", "conclusion": "running"},
+                {"name": "integration-tests (1)", "conclusion": "failure"},
+            ]
+
+        with (
+            patch.dict(
+                os.environ,
+                {
+                    "GITEA_URL": "https://gitea.example",
+                    "REPO_TOKEN": "token",
+                    "RUN_ID": "123",
+                    "JOB_NAME": "integration-tests",
+                    "MATRIX_INDEX": "0",
+                    "GITEA_REPOSITORY": "oblachno-oss/infra",
+                    "PATH": os.environ.get("PATH", ""),
+                },
+                clear=True,
+            ),
+            patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
+            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("os.killpg") as mock_killpg,
+            patch("os.getpgid") as mock_getpgid,
+            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+        ):
+            mock_getpgid.return_value = 123
+            proc = MagicMock()
+            proc.poll.return_value = None
+            proc.wait.side_effect = [subprocess.TimeoutExpired("cmd", 10)]
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 1
+            # SIGKILL should have been called (second killpg call)
+            assert mock_killpg.call_count >= 2
+
+    def test_no_env_vars_runs_without_polling(self) -> None:
+        with (
+            patch.dict(os.environ, {"PATH": os.environ.get("PATH", "")}, clear=True),
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 0
+            assert "without cross-runner cancellation" in result.output
+
+    def test_partial_env_vars_runs_without_polling(self) -> None:
+        """Only GITEA_URL set (missing REPO_TOKEN and RUN_ID) — should skip polling."""
+        with (
+            patch.dict(
+                os.environ,
+                {"GITEA_URL": "https://gitea.example", "PATH": os.environ.get("PATH", "")},
+                clear=True,
+            ),
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 0
+            assert "without cross-runner cancellation" in result.output
+
+    def test_invalid_repository_falls_back_to_default(self) -> None:
+        """GITEA_REPOSITORY without '/' falls back to oblachno-oss/devx."""
+        with (
+            patch.dict(
+                os.environ,
+                {"GITEA_REPOSITORY": "invalid", "PATH": os.environ.get("PATH", "")},
+                clear=True,
+            ),
+            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--", "test_foo.py"])
+            assert result.exit_code == 0
+
+
+def test_main_module_block() -> None:
+    import devx.ci.integration_guard as ig
+
+    with open(ig.__file__) as f:
+        source = f.read()
+    source = source.replace('if __name__ == "__main__":\n    cli()\n', "")
+    namespace = dict(ig.__dict__)
+    exec(compile(source, ig.__file__, "exec"), namespace)
+    assert callable(namespace["cli"])

tests/unit/test_merge_junit.py

@@ -0,0 +1,91 @@
+"""Unit tests for devx.ci.merge_junit."""
+
+from pathlib import Path
+from xml.etree import ElementTree as ET
+
+import pytest
+from click.testing import CliRunner
+
+from devx.ci.merge_junit import main, merge_files
+
+
+def _write_suite(path: Path, name: str, tests: int, failures: int) -> None:
+    suite = ET.Element("testsuite", name=name, tests=str(tests), failures=str(failures))
+    for i in range(tests):
+        tc = ET.SubElement(suite, "testcase", classname="cls", name=f"test{i}", time="0.1")
+        if i < failures:
+            ET.SubElement(tc, "failure", message="fail")
+    tree = ET.ElementTree(suite)
+    tree.write(path, encoding="UTF-8", xml_declaration=True)
+
+
+class TestMergeFiles:
+    def test_merges_multiple_suites(self, tmp_path: Path) -> None:
+        _write_suite(tmp_path / "runner-1.xml", "r1", tests=3, failures=1)
+        _write_suite(tmp_path / "runner-2.xml", "r2", tests=2, failures=0)
+        merged, total_tests, total_failures = merge_files(str(tmp_path / "runner-*.xml"))
+        assert total_tests == 5
+        assert total_failures == 1
+        assert merged.tag == "testsuites"
+        assert len(merged) == 2
+
+    def test_no_files_returns_empty(self, tmp_path: Path) -> None:
+        merged, total_tests, total_failures = merge_files(str(tmp_path / "nonexistent-*.xml"))
+        assert total_tests == 0
+        assert total_failures == 0
+        assert merged.tag == "testsuites"
+        assert len(merged) == 0
+
+    def test_handles_testsuites_wrapper_root(self, tmp_path: Path) -> None:
+        wrapper = ET.Element("testsuites")
+        suite = ET.SubElement(wrapper, "testsuite", name="r1", tests="4", failures="2")
+        ET.SubElement(suite, "testcase", classname="c", name="t", time="0.1")
+        tree = ET.ElementTree(wrapper)
+        tree.write(tmp_path / "runner-1.xml", encoding="UTF-8", xml_declaration=True)
+        merged, total_tests, total_failures = merge_files(str(tmp_path / "runner-*.xml"))
+        assert total_tests == 4
+        assert total_failures == 2
+
+
+class TestCli:
+    def test_writes_merged_file(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        _write_suite(tmp_path / "runner-1.xml", "r1", tests=2, failures=0)
+        _write_suite(tmp_path / "runner-2.xml", "r2", tests=3, failures=0)
+        out = tmp_path / "merged.xml"
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "runner-*.xml"), "--output", str(out)],
+        )
+        assert result.exit_code == 0
+        assert out.exists()
+        tree = ET.parse(out)
+        root = tree.getroot()
+        assert root.get("tests") == "5"
+        assert root.get("failures") == "0"
+
+    def test_exits_nonzero_on_failures(self, tmp_path: Path) -> None:
+        _write_suite(tmp_path / "runner-1.xml", "r1", tests=2, failures=1)
+        out = tmp_path / "merged.xml"
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "runner-*.xml"), "--output", str(out)],
+        )
+        assert result.exit_code != 0
+        assert "failures" in result.output
+
+    def test_no_files_exits_zero(self, tmp_path: Path) -> None:
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--pattern", str(tmp_path / "nonexistent-*.xml"), "--output", str(tmp_path / "out.xml")],
+        )
+        assert result.exit_code == 0
+        assert "No JUnit" in result.output or "skipping" in result.output
+
+
+def test_main_module_block() -> None:
+    import devx.ci.merge_junit as mod
+
+    assert hasattr(mod, "main")

tests/unit/test_molecule_ci_guard.py

@@ -5,8 +5,11 @@ from __future__ import annotations
 import os
 import subprocess  # nosec B404
 import time
+import xml.etree.ElementTree as ET
+from pathlib import Path
 from unittest.mock import MagicMock, patch
 
+import click
 import pytest
 import requests
 
@@ -16,7 +19,10 @@ from devx.molecule.molecule_ci_guard import (
     build_molecule_cmd,
     cli,
     get_running_jobs,
+    parse_pair,
     poll_for_other_failures,
+    resolve_role_dir,
+    write_junit_report,
 )
 
 
@@ -156,17 +162,26 @@ class TestCli:
 
         with (
             patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
             patch("time.sleep"),
         ):
             proc = MagicMock()
             proc.poll.return_value = 0
             proc.returncode = 0
             mock_popen.return_value = proc
+            mock_run.return_value = MagicMock(returncode=0)
 
             runner = CliRunner()
             result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
             assert result.exit_code == 0
             assert "All molecule tests passed" in result.output
+            # Verify Docker prune was called between scenarios
+            mock_run.assert_called_once_with(
+                ["docker", "system", "prune", "-af", "--volumes"],
+                check=False,
+                capture_output=True,
+                timeout=60,
+            )
 
     def test_invalid_pair_format_raises(self) -> None:
         """Pair with fewer than 2 parts should raise."""
@@ -318,6 +333,7 @@ class TestCli:
             ),
             patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
             patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
             patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs,
             patch("time.sleep", side_effect=lambda x: real_sleep(0.05)),
         ):
@@ -326,6 +342,7 @@ class TestCli:
             proc.poll.return_value = 0
             proc.returncode = 0
             mock_popen.return_value = proc
+            mock_run.return_value = MagicMock(returncode=0)
 
             runner = CliRunner()
             result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
@@ -435,3 +452,244 @@ def test_main_module_block() -> None:
     namespace = dict(mg.__dict__)
     exec(compile(source, mg.__file__, "exec"), namespace)
     assert callable(namespace["cli"])
+
+
+class TestParsePair:
+    def test_single_role_4_part(self) -> None:
+        role, scenario, name, image, cmd = parse_pair("default|ubuntu-2204|ubuntu:22.04|")
+        assert role == ""
+        assert scenario == "default"
+        assert name == "ubuntu-2204"
+        assert image == "ubuntu:22.04"
+        assert cmd == ""
+
+    def test_multi_role_5_part(self) -> None:
+        role, scenario, name, image, cmd = parse_pair("gitea-runner|default|ubuntu-2204|ubuntu:22.04|")
+        assert role == "gitea-runner"
+        assert scenario == "default"
+        assert name == "ubuntu-2204"
+        assert image == "ubuntu:22.04"
+        assert cmd == ""
+
+    def test_multi_role_with_command(self) -> None:
+        role, scenario, name, image, cmd = parse_pair(
+            "docker-base|lifecycle|archlinux|archlinux:latest|/usr/lib/systemd/systemd"
+        )
+        assert role == "docker-base"
+        assert scenario == "lifecycle"
+        assert cmd == "/usr/lib/systemd/systemd"
+
+    def test_invalid_pair_raises(self) -> None:
+        with pytest.raises(click.ClickException, match="Invalid pair format"):
+            parse_pair("only|two|parts")
+
+    def test_too_many_parts_raises(self) -> None:
+        with pytest.raises(click.ClickException, match="Invalid pair format"):
+            parse_pair("a|b|c|d|e|f")
+
+
+class TestResolveRoleDir:
+    def test_multi_role_with_roles_root(self, tmp_path: Path) -> None:
+        roles_root = tmp_path / "ansible" / "roles"
+        roles_root.mkdir(parents=True)
+        result = resolve_role_dir("gitea-runner", roles_root, tmp_path)
+        assert result == roles_root / "gitea-runner"
+
+    def test_multi_role_default_roles_root(self, tmp_path: Path) -> None:
+        result = resolve_role_dir("docker-base", None, tmp_path)
+        assert result == tmp_path / "ansible" / "roles" / "docker-base"
+
+    def test_single_role_uses_default(self, tmp_path: Path) -> None:
+        result = resolve_role_dir("", None, tmp_path)
+        assert result == tmp_path / "ansible" / "roles" / "gitea-runner"
+
+
+class TestWriteJunitReport:
+    def test_writes_report_with_passing_tests(self, tmp_path: Path) -> None:
+        output = str(tmp_path / "junit-results" / "runner-1.xml")
+        testcases = [
+            {"role": "gitea-runner", "scenario": "default", "time": 5.2, "passed": True, "error": None},
+            {"role": "docker-base", "scenario": "lifecycle", "time": 3.1, "passed": True, "error": None},
+        ]
+        write_junit_report(output, testcases, 1)
+        tree = ET.parse(output)
+        root = tree.getroot()
+        assert root.get("tests") == "2"
+        assert root.get("failures") == "0"
+        assert len(root) == 2
+
+    def test_writes_report_with_failures(self, tmp_path: Path) -> None:
+        output = str(tmp_path / "runner-2.xml")
+        testcases = [
+            {"role": "", "scenario": "default", "time": 1.0, "passed": False, "error": "Exit code: 1"},
+        ]
+        write_junit_report(output, testcases, 2)
+        tree = ET.parse(output)
+        root = tree.getroot()
+        assert root.get("tests") == "1"
+        assert root.get("failures") == "1"
+        failure = root[0][0]
+        assert failure.tag == "failure"
+        assert failure.text == "Exit code: 1"
+
+    def test_creates_parent_directory(self, tmp_path: Path) -> None:
+        output = str(tmp_path / "deep" / "nested" / "dir" / "runner.xml")
+        write_junit_report(output, [], 0)
+        assert Path(output).exists()
+
+
+class TestCliMultiRole:
+    def test_multi_role_pair_passes(self, tmp_path: Path) -> None:
+        from click.testing import CliRunner
+
+        roles_root = tmp_path / "ansible" / "roles"
+        (roles_root / "gitea-runner").mkdir(parents=True)
+
+        with (
+            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+            mock_run.return_value = MagicMock(returncode=0)
+
+            runner = CliRunner()
+            result = runner.invoke(
+                cli,
+                ["--roles-root", str(roles_root), "gitea-runner|default|ubuntu-2204|ubuntu:22.04|"],
+            )
+            assert result.exit_code == 0
+            assert "All molecule tests passed" in result.output
+
+    def test_junit_output_written(self, tmp_path: Path) -> None:
+        from click.testing import CliRunner
+
+        roles_root = tmp_path / "ansible" / "roles"
+        (roles_root / "gitea-runner").mkdir(parents=True)
+        junit_path = str(tmp_path / "junit-results" / "runner-1.xml")
+
+        with (
+            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 0
+            proc.returncode = 0
+            mock_popen.return_value = proc
+            mock_run.return_value = MagicMock(returncode=0)
+
+            runner = CliRunner()
+            result = runner.invoke(
+                cli,
+                [
+                    "--roles-root",
+                    str(roles_root),
+                    "--junit-output",
+                    junit_path,
+                    "gitea-runner|default|ubuntu-2204|ubuntu:22.04|",
+                ],
+            )
+            assert result.exit_code == 0
+            assert Path(junit_path).exists()
+
+    def test_junit_output_on_failure(self, tmp_path: Path) -> None:
+        from click.testing import CliRunner
+
+        roles_root = tmp_path / "ansible" / "roles"
+        (roles_root / "gitea-runner").mkdir(parents=True)
+        junit_path = str(tmp_path / "junit-results" / "runner-1.xml")
+
+        with (
+            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
+            patch("time.sleep"),
+        ):
+            proc = MagicMock()
+            proc.poll.return_value = 1
+            proc.returncode = 1
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(
+                cli,
+                [
+                    "--roles-root",
+                    str(roles_root),
+                    "--junit-output",
+                    junit_path,
+                    "gitea-runner|default|ubuntu-2204|ubuntu:22.04|",
+                ],
+            )
+            assert result.exit_code == 1
+            assert Path(junit_path).exists()
+            tree = ET.parse(junit_path)
+            assert tree.getroot().get("failures") == "1"
+
+    def test_junit_output_on_cancellation(self, tmp_path: Path) -> None:
+        """JUnit report is written when a runner is cancelled by another runner's failure."""
+        from click.testing import CliRunner
+
+        real_sleep = time.sleep
+        roles_root = tmp_path / "ansible" / "roles"
+        (roles_root / "gitea-runner").mkdir(parents=True)
+        junit_path = str(tmp_path / "junit-results" / "runner-1.xml")
+        call_count = [0]
+
+        def get_jobs_side_effect(*args, **kwargs):
+            call_count[0] += 1
+            if call_count[0] < 2:
+                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
+            return [
+                {"name": "molecule-tests (0)", "conclusion": "running"},
+                {"name": "molecule-tests (1)", "conclusion": "failure"},
+            ]
+
+        with (
+            patch.dict(
+                os.environ,
+                {
+                    "GITEA_URL": "https://gitea.example",
+                    "REPO_TOKEN": "token",
+                    "RUN_ID": "123",
+                    "JOB_NAME": "molecule-tests",
+                    "MATRIX_INDEX": "0",
+                    "GITEA_REPOSITORY": "oblachno-oss/infra",
+                    "PATH": os.environ.get("PATH", ""),
+                },
+                clear=True,
+            ),
+            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
+            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
+            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("os.killpg"),
+            patch("os.getpgid") as mock_getpgid,
+            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+        ):
+            mock_getpgid.return_value = 123
+            proc = MagicMock()
+            proc.poll.return_value = None
+            proc.wait.return_value = 0
+            mock_popen.return_value = proc
+
+            runner = CliRunner()
+            result = runner.invoke(
+                cli,
+                [
+                    "--roles-root",
+                    str(roles_root),
+                    "--junit-output",
+                    junit_path,
+                    "gitea-runner|default|ubuntu-2204|ubuntu:22.04|",
+                ],
+            )
+            assert result.exit_code == 1
+            assert Path(junit_path).exists()
+            tree = ET.parse(junit_path)
+            root = tree.getroot()
+            assert root.get("failures") == "1"
+            # The failure message should mention cancellation
+            failure = root[0][0]
+            assert "Cancelled" in (failure.text or "")

tests/unit/test_notify_failure.py

@@ -4,7 +4,7 @@ from unittest.mock import MagicMock, patch
 
 from click.testing import CliRunner
 
-from devx.ci.notify_failure import main
+from devx.ci.notify_failure import _configure_tea_login, main
 from devx.gitea_cli import TeaCLIError
 
 
@@ -114,3 +114,105 @@ class TestNotifyFailure:
         )
         assert result.exit_code != 0
         assert "REPO_TOKEN" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.shutil.which", return_value=None)
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_auto_login_no_tea_skips(self, mock_tea_cls: MagicMock, mock_which: MagicMock) -> None:
+        """--auto-login with tea not installed skips login and still creates issue."""
+        mock_tea = MagicMock()
+        mock_tea.list_labels.return_value = []
+        mock_tea.create_issue.return_value = {"index": 60, "title": "test"}
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "1", "--workflow", "release", "--commit", "abc", "--auto-login"],
+        )
+        assert result.exit_code == 0
+        assert "issue #60" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": ""}, clear=True)
+    @patch("devx.ci.notify_failure.shutil.which", return_value="/usr/bin/tea")
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_auto_login_no_token_skips_login(self, mock_tea_cls: MagicMock, mock_which: MagicMock) -> None:
+        """--auto-login with no REPO_TOKEN skips login but raises before creating issue."""
+        mock_tea = MagicMock()
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "1", "--workflow", "release", "--commit", "abc", "--auto-login"],
+        )
+        assert result.exit_code != 0
+        assert "REPO_TOKEN" in result.output
+
+
+class TestConfigureTeaLogin:
+    @patch.dict("os.environ", {"REPO_TOKEN": ""}, clear=True)
+    @patch("devx.ci.notify_failure.shutil.which", return_value="/usr/bin/tea")
+    def test_no_token_skips(self, mock_which: MagicMock) -> None:
+        """_configure_tea_login with no token prints skip message and returns."""
+        _configure_tea_login()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.shutil.which", return_value=None)
+    def test_no_tea_skips(self, mock_which: MagicMock) -> None:
+        """_configure_tea_login with no tea binary prints skip message and returns."""
+        _configure_tea_login()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.shutil.which", return_value="/usr/bin/tea")
+    @patch("devx.ci.notify_failure.subprocess.run")
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_auto_login_configures_tea(
+        self, mock_tea_cls: MagicMock, mock_subprocess: MagicMock, mock_which: MagicMock
+    ) -> None:
+        """--auto-login calls tea login add and default."""
+        mock_run = MagicMock()
+        mock_run.returncode = 0
+        mock_run.stdout = ""
+        mock_subprocess.return_value = mock_run
+
+        mock_tea = MagicMock()
+        mock_tea.list_labels.return_value = []
+        mock_tea.create_issue.return_value = {"index": 61, "title": "test"}
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "1", "--workflow", "release", "--commit", "abc", "--auto-login"],
+        )
+        assert result.exit_code == 0
+        assert "issue #61" in result.output
+        # tea login add was called
+        assert mock_subprocess.call_count >= 2
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.shutil.which", return_value="/usr/bin/tea")
+    @patch("devx.ci.notify_failure.subprocess.run")
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_auto_login_skips_if_already_configured(
+        self, mock_tea_cls: MagicMock, mock_subprocess: MagicMock, mock_which: MagicMock
+    ) -> None:
+        """--auto-login skips tea login add if login already exists."""
+        mock_list = MagicMock()
+        mock_list.returncode = 0
+        mock_list.stdout = "devx  https://git.example.com"
+        mock_subprocess.return_value = mock_list
+
+        mock_tea = MagicMock()
+        mock_tea.list_labels.return_value = []
+        mock_tea.create_issue.return_value = {"index": 62, "title": "test"}
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "1", "--workflow", "release", "--commit", "abc", "--auto-login"],
+        )
+        assert result.exit_code == 0
+        assert "already configured" in result.output

tests/unit/test_opentofu.py

@@ -0,0 +1,192 @@
+"""Unit tests for devx.opentofu."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from subprocess import CompletedProcess
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from devx.opentofu import get_tofu_output, get_tofu_vm_field, get_tofu_vm_ip
+
+
+class TestGetTofuOutput:
+    @patch("devx.opentofu.subprocess.run")
+    def test_returns_parsed_json(self, mock_run: MagicMock) -> None:
+        payload = {"staging": {"ipv4": "1.2.3.4"}}
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "customer_vms"],
+            returncode=0,
+            stdout=json.dumps(payload),
+            stderr="",
+        )
+        result = get_tofu_output("customer_vms", cwd="/tmp/tofu/staging")
+        assert result == payload
+        mock_run.assert_called_once()
+        call_kwargs = mock_run.call_args
+        assert call_kwargs.args[0] == ["tofu", "output", "-json", "customer_vms"]
+        assert call_kwargs.kwargs["cwd"] == "/tmp/tofu/staging"
+        assert call_kwargs.kwargs["env"] is None
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_with_env(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "obs"],
+            returncode=0,
+            stdout='{"staging": {"ipv4": "5.6.7.8"}}',
+            stderr="",
+        )
+        env = {"HCLOUD_TOKEN": "secret"}
+        result = get_tofu_output("obs", cwd=Path("/tmp"), env=env)
+        assert result == {"staging": {"ipv4": "5.6.7.8"}}
+        assert mock_run.call_args.kwargs["env"] == env
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_no_cwd(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "x"],
+            returncode=0,
+            stdout='{"a": 1}',
+            stderr="",
+        )
+        result = get_tofu_output("x")
+        assert result == {"a": 1}
+        assert mock_run.call_args.kwargs["cwd"] is None
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_pathlib_cwd(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "x"],
+            returncode=0,
+            stdout="{}",
+            stderr="",
+        )
+        get_tofu_output("x", cwd=Path("/some/path"))
+        assert mock_run.call_args.kwargs["cwd"] == "/some/path"
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_failure_raises_runtime_error(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "x"],
+            returncode=1,
+            stdout="",
+            stderr="Error: module not found",
+        )
+        with pytest.raises(RuntimeError, match="tofu output failed"):
+            get_tofu_output("x", cwd="/tmp")
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_invalid_json_raises(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "x"],
+            returncode=0,
+            stdout="not json",
+            stderr="",
+        )
+        with pytest.raises(json.JSONDecodeError):
+            get_tofu_output("x")
+
+
+class TestGetTofuVmIp:
+    @patch("devx.opentofu.subprocess.run")
+    def test_returns_ipv4(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "customer_vms"],
+            returncode=0,
+            stdout=json.dumps({"oblachno": {"ipv4": "10.0.0.1"}}),
+            stderr="",
+        )
+        ip = get_tofu_vm_ip("customer_vms", "oblachno", cwd="/tmp")
+        assert ip == "10.0.0.1"
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_missing_vm_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "customer_vms"],
+            returncode=0,
+            stdout=json.dumps({"other": {"ipv4": "10.0.0.2"}}),
+            stderr="",
+        )
+        ip = get_tofu_vm_ip("customer_vms", "missing", cwd="/tmp")
+        assert ip == ""
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_missing_ip_field_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "customer_vms"],
+            returncode=0,
+            stdout=json.dumps({"vm1": {"name": "test"}}),
+            stderr="",
+        )
+        ip = get_tofu_vm_ip("customer_vms", "vm1", cwd="/tmp")
+        assert ip == ""
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_custom_ip_field(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "vms"],
+            returncode=0,
+            stdout=json.dumps({"vm1": {"address": "192.168.1.1"}}),
+            stderr="",
+        )
+        ip = get_tofu_vm_ip("vms", "vm1", cwd="/tmp", ip_field="address")
+        assert ip == "192.168.1.1"
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_non_dict_output_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "vms"],
+            returncode=0,
+            stdout='["not", "a", "dict"]',
+            stderr="",
+        )
+        ip = get_tofu_vm_ip("vms", "vm1", cwd="/tmp")
+        assert ip == ""
+
+
+class TestGetTofuVmField:
+    @patch("devx.opentofu.subprocess.run")
+    def test_returns_field_value(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "obs"],
+            returncode=0,
+            stdout=json.dumps({"staging": {"volume_linux_device": "/dev/sda1"}}),
+            stderr="",
+        )
+        val = get_tofu_vm_field("obs", "staging", "volume_linux_device", cwd="/tmp")
+        assert val == "/dev/sda1"
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_missing_field_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "obs"],
+            returncode=0,
+            stdout=json.dumps({"staging": {"ipv4": "1.2.3.4"}}),
+            stderr="",
+        )
+        val = get_tofu_vm_field("obs", "staging", "volume_linux_device", cwd="/tmp")
+        assert val == ""
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_missing_vm_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "obs"],
+            returncode=0,
+            stdout=json.dumps({"prod": {"x": "y"}}),
+            stderr="",
+        )
+        val = get_tofu_vm_field("obs", "staging", "x", cwd="/tmp")
+        assert val == ""
+
+    @patch("devx.opentofu.subprocess.run")
+    def test_non_dict_output_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = CompletedProcess(
+            args=["tofu", "output", "-json", "obs"],
+            returncode=0,
+            stdout='"a string"',
+            stderr="",
+        )
+        val = get_tofu_vm_field("obs", "staging", "x", cwd="/tmp")
+        assert val == ""

tests/unit/test_platforms.py

@@ -1,11 +1,13 @@
-"""Unit tests for scripts/ci/platforms.py."""
+"""Unit tests for devx.molecule.platforms."""
 
-from devx.molecule.platforms import PLATFORMS
+import json
+
+from devx.molecule.platforms import PLATFORMS, load_platforms
 
 
 class TestPlatforms:
     def test_platforms_not_empty(self) -> None:
-        assert len(PLATFORMS) >= 4
+        assert len(PLATFORMS) >= 1
 
     def test_each_platform_has_required_keys(self) -> None:
         for p in PLATFORMS:
@@ -17,9 +19,40 @@ class TestPlatforms:
         names = [p["name"] for p in PLATFORMS]
         assert len(names) == len(set(names))
 
+    def test_platforms_use_sleep_infinity(self) -> None:
+        """All default platforms must use sleep infinity, not systemd."""
+        for p in PLATFORMS:
+            assert p["command"] == "sleep infinity", f"Platform {p['name']} uses {p['command']}"
+
     def test_known_platforms_present(self) -> None:
         names = {p["name"] for p in PLATFORMS}
-        assert "ubuntu-2204" in names
-        assert "ubuntu-2404" in names
-        assert "debian-12" in names
-        assert "archlinux" in names
+        assert "ubuntu-2604" in names
+
+
+class TestLoadPlatforms:
+    def test_load_platforms_default(self, tmp_path) -> None:  # type: ignore[no-untyped-def]
+        """load_platforms with no file returns PLATFORMS."""
+        result = load_platforms(None)
+        assert result == PLATFORMS
+
+    def test_load_platforms_from_file(self, tmp_path) -> None:  # type: ignore[no-untyped-def]
+        """load_platforms reads custom platforms from JSON file."""
+        custom = [
+            {"name": "custom-os", "image": "custom:latest", "command": "sleep infinity"},
+        ]
+        f = tmp_path / "platforms.json"
+        f.write_text(json.dumps(custom))
+        result = load_platforms(f)
+        assert result == custom
+
+    def test_load_platforms_missing_file_falls_back(self, tmp_path) -> None:  # type: ignore[no-untyped-def]
+        """load_platforms falls back to PLATFORMS when file doesn't exist."""
+        result = load_platforms(tmp_path / "nonexistent.json")
+        assert result == PLATFORMS
+
+    def test_load_platforms_empty_list_falls_back(self, tmp_path) -> None:  # type: ignore[no-untyped-def]
+        """load_platforms falls back to PLATFORMS when file has empty list."""
+        f = tmp_path / "platforms.json"
+        f.write_text("[]")
+        result = load_platforms(f)
+        assert result == PLATFORMS

tests/unit/test_publish.py

@@ -1,5 +1,6 @@
 """Unit tests for devx.ci.publish."""
 
+from pathlib import Path
 from unittest.mock import MagicMock, patch
 
 import click
@@ -64,7 +65,8 @@ class TestGenerateReleaseNotes:
 
 class TestBuildPackage:
     @patch("devx.ci.publish.subprocess.run")
-    def test_success(self, mock_run: MagicMock) -> None:
+    @patch("devx.ci.publish.Path.exists", return_value=False)
+    def test_success(self, mock_exists: MagicMock, mock_run: MagicMock) -> None:
         mock_run.return_value = MagicMock(returncode=0, stderr="")
         build_package()
         args, _ = mock_run.call_args
@@ -72,12 +74,23 @@ class TestBuildPackage:
         assert args[0][2] == "build"
 
     @patch("devx.ci.publish.subprocess.run")
-    def test_failure_raises(self, mock_run: MagicMock) -> None:
+    @patch("devx.ci.publish.Path.exists", return_value=False)
+    def test_failure_raises(self, mock_exists: MagicMock, mock_run: MagicMock) -> None:
         mock_run.return_value = MagicMock(returncode=1, stderr="build error")
         with pytest.raises(click.ClickException) as exc:
             build_package()
         assert "build" in str(exc.value)
 
+    @patch("devx.ci.publish.subprocess.run")
+    @patch("devx.ci.publish.shutil.rmtree")
+    @patch("devx.ci.publish.Path.exists", return_value=True)
+    def test_cleans_dist_before_build(
+        self, mock_exists: MagicMock, mock_rmtree: MagicMock, mock_run: MagicMock
+    ) -> None:
+        mock_run.return_value = MagicMock(returncode=0, stderr="")
+        build_package()
+        mock_rmtree.assert_called_once_with(Path("dist"))
+
 
 class TestPublishToPypi:
     @patch("devx.ci.publish.subprocess.run")
@@ -149,6 +162,7 @@ class TestMain:
         mock_notes: MagicMock,
     ) -> None:
         mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
         mock_tea_cls.return_value = mock_tea
         runner = CliRunner()
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
@@ -174,6 +188,7 @@ class TestMain:
     ) -> None:
         """When no PYPI_TOKEN, publishes to Gitea PyPI registry."""
         mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
         mock_tea_cls.return_value = mock_tea
         runner = CliRunner()
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
@@ -196,6 +211,7 @@ class TestMain:
     ) -> None:
         """--registry-url flag publishes to the specified Gitea registry."""
         mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
         mock_tea_cls.return_value = mock_tea
         runner = CliRunner()
         result = runner.invoke(
@@ -223,6 +239,7 @@ class TestMain:
     ) -> None:
         """DEVX_PYPI_REGISTRY_URL env var sets the registry URL."""
         mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
         mock_tea_cls.return_value = mock_tea
         runner = CliRunner()
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
@@ -243,6 +260,7 @@ class TestMain:
     ) -> None:
         """When no PYPI_TOKEN and no registry URL, skips publish and creates release only."""
         mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
         mock_tea_cls.return_value = mock_tea
         runner = CliRunner()
         result = runner.invoke(main, ["v1.0.0", "owner/repo", "--registry-url", ""])
@@ -294,9 +312,64 @@ class TestMain:
         self, mock_build: MagicMock, mock_publish: MagicMock, mock_tea_cls: MagicMock, mock_notes: MagicMock
     ) -> None:
         mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
         mock_tea.create_release.side_effect = TeaCLIError("server error")
         mock_tea_cls.return_value = mock_tea
         runner = CliRunner()
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
         assert result.exit_code == 1
         assert "Release creation failed" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "gitea-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.build_package")
+    def test_skip_build_skips_build_and_publish(
+        self, mock_build: MagicMock, mock_tea_cls: MagicMock, mock_notes: MagicMock
+    ) -> None:
+        """--skip-build skips build_package and PyPI publish, only creates Gitea release."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo", "--skip-build"])
+        assert result.exit_code == 0
+        assert "skip" in result.output.lower()
+        mock_build.assert_not_called()
+        mock_tea.create_release.assert_called_once()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "gitea-tok", "PYPI_TOKEN": "pypi-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.publish_to_pypi")
+    @patch("devx.ci.publish.build_package")
+    def test_skips_release_creation_when_already_exists(
+        self, mock_build: MagicMock, mock_publish: MagicMock, mock_tea_cls: MagicMock, mock_notes: MagicMock
+    ) -> None:
+        """If the Gitea release already exists, skip creation (idempotent)."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = [{"tag_name": "v1.0.0"}]
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo"])
+        assert result.exit_code == 0
+        assert "already exists" in result.output
+        mock_tea.create_release.assert_not_called()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "gitea-tok", "PYPI_TOKEN": "pypi-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.publish_to_pypi")
+    @patch("devx.ci.publish.build_package")
+    def test_proceeds_to_create_when_list_releases_fails(
+        self, mock_build: MagicMock, mock_publish: MagicMock, mock_tea_cls: MagicMock, mock_notes: MagicMock
+    ) -> None:
+        """If list_releases raises TeaCLIError, proceed to create the release."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.side_effect = TeaCLIError("api error")
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo"])
+        assert result.exit_code == 0
+        assert "Gitea release v1.0.0 created" in result.output
+        mock_tea.create_release.assert_called_once()

tests/unit/test_push_badges.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+from typing import Any
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -223,3 +224,82 @@ class TestMain:
             result = runner.invoke(push_badges.main, ["--output-dir", str(badges_dir), "--no-readme-update"])
         assert result.exit_code == 0
         mock_update.assert_not_called()
+
+    def test_retries_success_on_second_attempt(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """With --retries 3, first attempt fails but second succeeds."""
+        monkeypatch.chdir(tmp_path)
+        badges_dir = tmp_path / ".badges"
+        badges_dir.mkdir()
+        (badges_dir / "badge1.svg").touch()
+
+        import subprocess
+
+        call_count = [0]
+
+        def side_effect(*args: Any, **kwargs: Any) -> Any:
+            call_count[0] += 1
+            # First call (git fetch) fails, rest succeed
+            if call_count[0] == 1:
+                raise subprocess.CalledProcessError(1, "git fetch")
+            return MagicMock(returncode=0, stdout="", stderr="")
+
+        runner = CliRunner()
+        with (
+            patch("subprocess.run", side_effect=side_effect),
+            patch("devx.ci.push_badges.update_readme_with_badge_sha"),
+            patch("time.sleep"),
+        ):
+            result = runner.invoke(
+                push_badges.main,
+                ["--output-dir", str(badges_dir), "--no-readme-update", "--retries", "3"],
+            )
+        assert result.exit_code == 0
+
+    def test_retries_exhausted(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """With --retries 2, all attempts fail and exit code is non-zero."""
+        monkeypatch.chdir(tmp_path)
+
+        import subprocess
+
+        runner = CliRunner()
+        with (
+            patch("subprocess.run", side_effect=subprocess.CalledProcessError(1, "git fetch")),
+            patch("time.sleep"),
+        ):
+            result = runner.invoke(
+                push_badges.main,
+                ["--no-readme-update", "--retries", "2"],
+            )
+        assert result.exit_code != 0
+        assert "failed after 2" in result.output
+
+    def test_default_retries_is_one(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """Without --retries, only one attempt is made (no retry on failure)."""
+        monkeypatch.chdir(tmp_path)
+
+        import subprocess
+
+        runner = CliRunner()
+        with (
+            patch("subprocess.run", side_effect=subprocess.CalledProcessError(1, "git fetch")),
+            patch("time.sleep") as mock_sleep,
+        ):
+            result = runner.invoke(push_badges.main, ["--no-readme-update"])
+        assert result.exit_code != 0
+        mock_sleep.assert_not_called()
+
+
+class TestRepoRoot:
+    def test_uses_github_workspace(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setenv("GITHUB_WORKSPACE", str(tmp_path))
+        assert push_badges._repo_root() == tmp_path
+
+    def test_falls_back_to_cwd(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv("GITHUB_WORKSPACE", raising=False)
+        monkeypatch.chdir(tmp_path)
+        assert push_badges._repo_root() == tmp_path
+
+    def test_falls_back_when_workspace_invalid(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setenv("GITHUB_WORKSPACE", "/nonexistent")
+        monkeypatch.chdir(tmp_path)
+        assert push_badges._repo_root() == tmp_path

tests/unit/test_release.py

@@ -9,9 +9,16 @@ from click.testing import CliRunner
 from devx.ci.release import (
     commit_release_changes,
     create_and_push_tag,
+    fetch_tags,
+    get_all_tags,
     get_bumped_version,
     get_changelog,
+    get_changelog_versions,
+    get_commit_version,
+    get_head_commit,
+    get_init_version,
     get_latest_tag,
+    get_tag_commit,
     has_unreleased_changes,
     main,
     run_cmd,
@@ -19,6 +26,8 @@ from devx.ci.release import (
     tag_exists,
     update_changelog,
     update_init_version,
+    verify_alignment,
+    verify_tag_consistency,
 )
 
 
@@ -44,14 +53,14 @@ class TestRunCmd:
 
 
 class TestGetLatestTag:
-    @patch("devx.ci.release.run_cmd")
-    def test_returns_tag(self, mock_run_cmd: MagicMock) -> None:
-        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="v0.1.0\n")
+    @patch("devx.ci._shared.subprocess.run")
+    def test_returns_tag(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=0, stdout="v0.1.0\n")
         assert get_latest_tag() == "v0.1.0"
 
-    @patch("devx.ci.release.run_cmd")
-    def test_no_tags_returns_empty(self, mock_run_cmd: MagicMock) -> None:
-        mock_run_cmd.return_value = MagicMock(returncode=1, stdout="")
+    @patch("devx.ci._shared.subprocess.run")
+    def test_no_tags_returns_empty(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=1, stdout="")
         assert get_latest_tag() == ""
 
 
@@ -156,6 +165,543 @@ class TestUpdateInitVersion:
             update_init_version("0.2.0")
 
 
+class TestGetTagCommit:
+    @patch("devx.ci.release.run_cmd")
+    def test_returns_commit(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="abc123\n", stderr="")
+        assert get_tag_commit("v0.1.0") == "abc123"
+
+    @patch("devx.ci.release.run_cmd")
+    def test_returns_empty_on_failure(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=1, stdout="", stderr="err")
+        assert get_tag_commit("v0.1.0") == ""
+
+
+class TestGetHeadCommit:
+    @patch("devx.ci.release.run_cmd")
+    def test_returns_head(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="def456\n", stderr="")
+        assert get_head_commit() == "def456"
+
+
+class TestFetchTags:
+    @patch("devx.ci.release.run_cmd")
+    def test_success(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        fetch_tags()
+
+    @patch("devx.ci.release.run_cmd")
+    def test_failure_warns(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=1, stdout="", stderr="err")
+        # Should not raise
+        fetch_tags()
+
+
+class TestGetAllTags:
+    @patch("devx.ci.release.run_cmd")
+    def test_returns_tags(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="v0.3.0\nv0.2.0\nv0.1.0\n", stderr="")
+        tags = get_all_tags()
+        assert tags == ["v0.3.0", "v0.2.0", "v0.1.0"]
+
+    @patch("devx.ci.release.run_cmd")
+    def test_empty(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="\n", stderr="")
+        assert get_all_tags() == []
+
+    @patch("devx.ci.release.run_cmd")
+    def test_failure_returns_empty(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=1, stdout="", stderr="err")
+        assert get_all_tags() == []
+
+
+class TestGetCommitVersion:
+    @patch("devx.ci.release.run_cmd")
+    def test_release_commit(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="release: v0.4.4 [skip ci]\n", stderr="")
+        assert get_commit_version("abc123") == "0.4.4"
+
+    @patch("devx.ci.release.run_cmd")
+    def test_non_release_commit(self, mock_run_cmd: MagicMock) -> None:
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="DEVX-9 feat: add thing\n", stderr="")
+        assert get_commit_version("abc123") is None
+
+
+class TestVerifyTagConsistency:
+    @patch("devx.ci.release.get_commit_version")
+    @patch("devx.ci.release.get_all_tags")
+    def test_all_consistent(self, mock_tags: MagicMock, mock_cv: MagicMock) -> None:
+        mock_tags.return_value = ["v0.2.0", "v0.1.0"]
+        mock_cv.side_effect = ["0.2.0", "0.1.0"]
+        errors = verify_tag_consistency()
+        assert errors == []
+
+    @patch("devx.ci.release.get_commit_version")
+    @patch("devx.ci.release.get_all_tags")
+    def test_tag_on_non_release_commit(self, mock_tags: MagicMock, mock_cv: MagicMock) -> None:
+        # v0.1.0 is first (exempt), v0.2.0 is non-release (should error)
+        mock_tags.return_value = ["v0.2.0", "v0.1.0"]
+        mock_cv.side_effect = [None, "0.1.0"]  # v0.2.0 non-release, v0.1.0 ok
+        errors = verify_tag_consistency()
+        assert len(errors) == 1
+        assert "non-release commit" in errors[0]
+
+    @patch("devx.ci.release.get_commit_version")
+    @patch("devx.ci.release.get_all_tags")
+    def test_first_tag_exempt_from_release_check(self, mock_tags: MagicMock, mock_cv: MagicMock) -> None:
+        """The first (oldest) tag is allowed to point to a non-release commit."""
+        mock_tags.return_value = ["v0.1.0"]
+        mock_cv.return_value = None  # non-release commit
+        errors = verify_tag_consistency()
+        assert errors == []  # no error — first tag is exempt
+
+    @patch("devx.ci.release.get_commit_version")
+    @patch("devx.ci.release.get_all_tags")
+    def test_tag_version_mismatch(self, mock_tags: MagicMock, mock_cv: MagicMock) -> None:
+        mock_tags.return_value = ["v0.2.0"]
+        mock_cv.return_value = "0.1.0"
+        errors = verify_tag_consistency()
+        assert len(errors) == 1
+        assert "0.1.0" in errors[0]
+        assert "0.2.0" in errors[0]
+
+    @patch("devx.ci.release.get_all_tags")
+    def test_no_tags(self, mock_tags: MagicMock) -> None:
+        mock_tags.return_value = []
+        assert verify_tag_consistency() == []
+
+    @patch("devx.ci.release.get_commit_version")
+    @patch("devx.ci.release.get_all_tags")
+    def test_non_version_tags_ignored(self, mock_tags: MagicMock, mock_cv: MagicMock) -> None:
+        """Non-version tags like 'master' should be skipped, not crash."""
+        mock_tags.return_value = ["v0.2.0", "master", "v0.1.0"]
+        mock_cv.side_effect = ["0.2.0", "0.1.0"]  # only version tags get checked
+        errors = verify_tag_consistency()
+        assert errors == []
+
+
+class TestGetInitVersion:
+    def test_returns_version(self, tmp_path, monkeypatch) -> None:
+        init_file = tmp_path / "__init__.py"
+        init_file.write_text('__version__ = "0.4.4"\n')
+        monkeypatch.setattr("devx.ci.release.INIT_FILE", str(init_file))
+        assert get_init_version() == "0.4.4"
+
+    def test_file_not_found(self, monkeypatch) -> None:
+        monkeypatch.setattr("devx.ci.release.INIT_FILE", "/nonexistent/path/__init__.py")
+        assert get_init_version() is None
+
+    def test_no_version_string(self, tmp_path, monkeypatch) -> None:
+        init_file = tmp_path / "__init__.py"
+        init_file.write_text('"""module"""\n')
+        monkeypatch.setattr("devx.ci.release.INIT_FILE", str(init_file))
+        assert get_init_version() is None
+
+
+class TestGetChangelogVersions:
+    def test_returns_versions(self, tmp_path, monkeypatch) -> None:
+        changelog = tmp_path / "CHANGELOG.md"
+        changelog.write_text(
+            "# Changelog\n\n## [0.4.4] - 2026-06-21\n\n### Features\n- new\n\n"
+            "## [0.4.3] - 2026-06-20\n\n### Fixes\n- fix\n\n## [0.4.2] - 2026-06-19\n"
+        )
+        monkeypatch.setattr("devx.ci.release.CHANGELOG_FILE", str(changelog))
+        versions = get_changelog_versions()
+        assert versions == ["0.4.4", "0.4.3", "0.4.2"]
+
+    def test_file_not_found(self, monkeypatch) -> None:
+        monkeypatch.setattr("devx.ci.release.CHANGELOG_FILE", "/nonexistent/CHANGELOG.md")
+        assert get_changelog_versions() == []
+
+
+class TestVerifyAlignment:
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_all_aligned(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment passes when everything is consistent."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4", "v0.4.3"]
+        mock_vtc.return_value = []  # no tag errors
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4", "0.4.3"]
+        # run_cmd is called for untagged release commits check
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 0
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_misaligned_tags(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when tags are misaligned."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = ["  v0.1.0 → bad"]
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4"]
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_version_mismatch(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when __version__ != latest tag."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.3"  # mismatch
+        mock_cv.return_value = ["0.4.4"]
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_changelog_duplicates(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when CHANGELOG has duplicate versions."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4", "0.4.4"]  # duplicate
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_changelog_out_of_order(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when CHANGELOG versions are not descending."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.3", "0.4.4"]  # out of order
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_changelog_latest_mismatch(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when CHANGELOG latest != latest tag."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.3"]  # doesn't match tag
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_changelog_unreleased_section(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify passes when CHANGELOG has one unreleased section ahead of tag."""
+        mock_lt.return_value = "v0.6.3"
+        mock_tags.return_value = ["v0.6.3", "v0.6.2"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.6.3"
+        mock_cv.return_value = ["0.6.4", "0.6.3"]  # 0.6.4 is unreleased
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 0
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_changelog_tag_at_wrong_position(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify fails when latest tag is deep in CHANGELOG (not at position 0 or 1)."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.5.0", "0.4.5", "0.4.4"]  # tag at position 2
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_duplicate_release_commits_info(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify reports duplicate release commits as info, not error."""
+        mock_lt.return_value = "v0.6.1"
+        mock_tags.return_value = ["v0.6.1"]  # tag for 0.6.1 exists
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.6.1"
+        mock_cv.return_value = ["0.6.1"]
+        # git log finds 2 release commits for v0.6.1, neither has tag pointing at it
+        # (the tag points to a third commit)
+        commits = "abc123 release: v0.6.1 [skip ci]\ndef456 release: v0.6.1 [skip ci]\n"
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout=commits, stderr=""),
+            MagicMock(returncode=0, stdout="", stderr=""),  # no tag at abc123
+            MagicMock(returncode=0, stdout="", stderr=""),  # no tag at def456
+        ]
+        # Should return 0 — duplicates are informational, not errors
+        assert verify_alignment() == 0
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_many_duplicate_release_commits(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify handles >5 duplicate release commits (truncation message)."""
+        mock_lt.return_value = "v0.6.1"
+        mock_tags.return_value = ["v0.6.1"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.6.1"
+        mock_cv.return_value = ["0.6.1"]
+        # Generate 7 duplicate release commits for v0.6.1
+        commits = "\n".join(f"abc{i:03d} release: v0.6.1 [skip ci]" for i in range(7))
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout=commits + "\n", stderr=""),
+        ] + [MagicMock(returncode=0, stdout="", stderr="") for _ in range(7)]
+        assert verify_alignment() == 0
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_untagged_release_commits(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when there are untagged release commits."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4"]
+        # git log finds release commits, then tag --points-at finds nothing
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout="abc123 release: v0.3.0 [skip ci]\n", stderr=""),
+            MagicMock(returncode=0, stdout="", stderr=""),  # no tags at abc123
+        ]
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_no_init_version(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify alignment fails when __version__ is not found."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = None  # not found
+        mock_cv.return_value = ["0.4.4"]
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 1
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_all_release_commits_tagged(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify passes when all release commits have tags."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4"]
+        # git log finds release commit, tag --points-at finds the tag
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout="abc123 release: v0.4.4 [skip ci]\n", stderr=""),
+            MagicMock(returncode=0, stdout="v0.4.4\n", stderr=""),  # tag found
+        ]
+        assert verify_alignment() == 0
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_no_release_commits_found(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify handles case with no release commits at all."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4"]
+        mock_run_cmd.return_value = MagicMock(returncode=1, stdout="", stderr="")
+        assert verify_alignment() == 0
+
+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_many_untagged_release_commits(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """Verify handles >10 untagged release commits (truncation message)."""
+        mock_lt.return_value = "v0.4.4"
+        mock_tags.return_value = ["v0.4.4"]
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4"]
+        # Generate 15 untagged release commits
+        commits = "\n".join(f"abc{i:03d} release: v0.1.{i} [skip ci]" for i in range(15))
+        # First call returns all commits, subsequent calls return empty (no tags)
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout=commits + "\n", stderr=""),
+        ] + [MagicMock(returncode=0, stdout="", stderr="") for _ in range(15)]
+        assert verify_alignment() == 1
+
+
 class TestUpdateChangelog:
     def test_creates_new_file(self, tmp_path, monkeypatch) -> None:
         changelog_file = tmp_path / "CHANGELOG.md"
@@ -239,7 +785,7 @@ class TestCreateAndPushTag:
         create_and_push_tag("0.2.0", "changelog", dry_run=False)
         calls = [c.args[0] for c in mock_run_cmd.call_args_list]
         assert ["git", "tag", "-a", "v0.2.0", "-m", "Release v0.2.0\n\nchangelog"] in calls
-        assert ["git", "push", "origin", "v0.2.0"] in calls
+        assert ["git", "push", "origin", "refs/tags/v0.2.0"] in calls
 
     @patch("devx.ci.release.tag_exists", return_value=False)
     @patch("devx.ci.release.run_cmd")
@@ -250,23 +796,56 @@ class TestCreateAndPushTag:
             assert call.args[0][0:2] != ["git", "push"]
             assert call.args[0][0:2] != ["git", "tag"]
 
+    @patch("devx.ci.release.get_head_commit", return_value="abc123")
+    @patch("devx.ci.release.get_tag_commit", return_value="abc123")
     @patch("devx.ci.release.tag_exists", return_value=True)
     @patch("devx.ci.release.run_cmd")
-    def test_tag_exists_skips_creation(self, mock_run_cmd: MagicMock, mock_tag_exists: MagicMock) -> None:
+    def test_tag_exists_skips_creation(
+        self,
+        mock_run_cmd: MagicMock,
+        mock_tag_exists: MagicMock,
+        mock_tag_commit: MagicMock,
+        mock_head_commit: MagicMock,
+    ) -> None:
         result = create_and_push_tag("0.1.0", "changelog", dry_run=False)
         assert result is False
         # Should not create tag, but should ensure it's pushed
         calls = [c.args[0] for c in mock_run_cmd.call_args_list]
         assert ["git", "tag", "-a"] not in [c[:3] for c in calls]
-        assert ["git", "push", "origin", "v0.1.0"] in calls
+        assert ["git", "push", "origin", "refs/tags/v0.1.0"] in calls
 
+    @patch("devx.ci.release.get_head_commit", return_value="def456")
+    @patch("devx.ci.release.get_tag_commit", return_value="abc123")
     @patch("devx.ci.release.tag_exists", return_value=True)
     @patch("devx.ci.release.run_cmd")
-    def test_tag_exists_dry_run_no_push(self, mock_run_cmd: MagicMock, mock_tag_exists: MagicMock) -> None:
+    def test_tag_exists_mismatch_raises(
+        self,
+        mock_run_cmd: MagicMock,
+        mock_tag_exists: MagicMock,
+        mock_tag_commit: MagicMock,
+        mock_head_commit: MagicMock,
+    ) -> None:
+        """Tag exists but points to different commit than HEAD → error."""
+        with pytest.raises(click.ClickException, match="misalignment"):
+            create_and_push_tag("0.1.0", "changelog", dry_run=False)
+
+    @patch("devx.ci.release.get_head_commit", return_value="abc123")
+    @patch("devx.ci.release.get_tag_commit", return_value="abc123")
+    @patch("devx.ci.release.tag_exists", return_value=True)
+    @patch("devx.ci.release.run_cmd")
+    def test_tag_exists_dry_run_no_push(
+        self,
+        mock_run_cmd: MagicMock,
+        mock_tag_exists: MagicMock,
+        mock_tag_commit: MagicMock,
+        mock_head_commit: MagicMock,
+    ) -> None:
         result = create_and_push_tag("0.1.0", "changelog", dry_run=True)
         assert result is False
-        # No git commands at all in dry-run when tag exists
-        mock_run_cmd.assert_not_called()
+        # No push in dry-run when tag exists, but alignment check still runs
+        for call in mock_run_cmd.call_args_list:
+            assert call.args[0][0:2] != ["git", "push"]
+            assert call.args[0][0:2] != ["git", "tag"]
 
 
 class TestRunTests:
@@ -302,6 +881,13 @@ class TestRunTests:
 
 
 class TestMain:
+    """Tests for the main release command.
+
+    All tests mock fetch_tags and verify_tag_consistency since these
+    are pre-flight checks that call git commands. Tests that need to
+    verify specific git call sequences mock run_cmd with side_effect.
+    """
+
     @patch.dict("os.environ", {})
     @patch("devx.ci.release.run_cmd")
     def test_not_on_master_exits(self, mock_run_cmd: MagicMock) -> None:
@@ -312,9 +898,13 @@ class TestMain:
         assert "master" in result.output
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.get_latest_tag", return_value="v0.5.0")
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
     @patch("devx.ci.release.has_user_facing_changes", return_value=False)
     @patch("devx.ci.release.run_cmd")
-    def test_dry_run_on_non_master_warns(self, mock_run_cmd: MagicMock, mock_uf: MagicMock) -> None:
+    def test_dry_run_on_non_master_warns(
+        self, mock_run_cmd: MagicMock, mock_uf: MagicMock, mock_vtc: MagicMock, mock_glt: MagicMock
+    ) -> None:
         """Dry-run mode should not fail on non-master branches."""
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="feature-branch\n", stderr="")
         runner = CliRunner()
@@ -323,13 +913,22 @@ class TestMain:
         assert "Dry-run mode" in result.output
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.get_head_commit", return_value="abc123")
+    @patch("devx.ci.release.get_tag_commit", return_value="abc123")
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.run_cmd")
     def test_release_lock_skips_when_head_is_release_commit_and_tag_exists(
-        self, mock_run_cmd: MagicMock, mock_uf: MagicMock
+        self,
+        mock_run_cmd: MagicMock,
+        mock_uf: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
+        mock_tc: MagicMock,
+        mock_hc: MagicMock,
     ) -> None:
         """If HEAD is a release commit and the tag exists, skip."""
-        # git rev-parse, git log -1, git tag -l (tag exists)
         mock_run_cmd.side_effect = [
             MagicMock(returncode=0, stdout="master\n", stderr=""),
             MagicMock(returncode=0, stdout="release: v0.5.0\n", stderr=""),
@@ -342,14 +941,47 @@ class TestMain:
         assert "Skipping" in result.output
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.get_head_commit", return_value="def456")
+    @patch("devx.ci.release.get_tag_commit", return_value="abc123")
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
+    @patch("devx.ci.release.has_user_facing_changes", return_value=True)
+    @patch("devx.ci.release.run_cmd")
+    def test_release_lock_tag_points_elsewhere(
+        self,
+        mock_run_cmd: MagicMock,
+        mock_uf: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
+        mock_tc: MagicMock,
+        mock_hc: MagicMock,
+    ) -> None:
+        """If HEAD is a release commit but tag points elsewhere, error."""
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout="master\n", stderr=""),
+            MagicMock(returncode=0, stdout="release: v0.5.0\n", stderr=""),
+            MagicMock(returncode=0, stdout="v0.5.0\n", stderr=""),  # tag -l finds tag
+        ]
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code != 0
+        assert "misalignment" in result.output
+
+    @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.get_changelog", return_value="## changelog")
     @patch("devx.ci.release.create_and_push_tag", return_value=True)
     @patch("devx.ci.release.run_cmd")
     def test_release_lock_recovers_when_tag_missing(
-        self, mock_run_cmd: MagicMock, mock_create_tag: MagicMock, mock_changelog: MagicMock
+        self,
+        mock_run_cmd: MagicMock,
+        mock_create_tag: MagicMock,
+        mock_changelog: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """If HEAD is a release commit but the tag is missing, create the tag."""
-        # git rev-parse, git log -1, git tag -l (tag NOT found)
         mock_run_cmd.side_effect = [
             MagicMock(returncode=0, stdout="master\n", stderr=""),
             MagicMock(returncode=0, stdout="release: v0.5.0\n", stderr=""),
@@ -363,6 +995,8 @@ class TestMain:
         mock_create_tag.assert_called_once_with("0.5.0", "## changelog", False)
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.has_unreleased_changes", return_value=False)
     @patch("devx.ci.release.get_bumped_version", return_value="0.2.0")
@@ -373,6 +1007,8 @@ class TestMain:
         mock_bumped: MagicMock,
         mock_has: MagicMock,
         mock_user: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
         runner = CliRunner()
@@ -381,6 +1017,7 @@ class TestMain:
         assert "No unreleased changes" in result.output
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.create_and_push_tag")
     @patch("devx.ci.release.commit_release_changes")
@@ -403,6 +1040,7 @@ class TestMain:
         mock_commit: MagicMock,
         mock_tag: MagicMock,
         mock_user: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """Empty changelog should fail, not warn."""
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
@@ -412,6 +1050,7 @@ class TestMain:
         assert "empty changelog" in result.output.lower()
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.create_and_push_tag")
     @patch("devx.ci.release.commit_release_changes")
@@ -434,6 +1073,7 @@ class TestMain:
         mock_commit: MagicMock,
         mock_tag: MagicMock,
         mock_user: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
         runner = CliRunner()
@@ -446,6 +1086,8 @@ class TestMain:
         mock_tag.assert_not_called()
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.get_latest_tag", return_value="v0.3.0")
     @patch("devx.ci.release.has_user_facing_changes", return_value=False)
     @patch("devx.ci.release.run_cmd")
@@ -454,6 +1096,8 @@ class TestMain:
         mock_run_cmd: MagicMock,
         mock_user_facing: MagicMock,
         mock_latest: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """Release is skipped when only workflow/infra files changed."""
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
@@ -464,6 +1108,8 @@ class TestMain:
         assert "Skipping release" in result.output
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.run_tests")
     @patch("devx.ci.release.create_and_push_tag", return_value=True)
@@ -488,6 +1134,8 @@ class TestMain:
         mock_tag: MagicMock,
         mock_run_tests: MagicMock,
         mock_user: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
         runner = CliRunner()
@@ -501,6 +1149,8 @@ class TestMain:
         mock_tag.assert_called_once_with("0.2.0", "changelog", False)
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.run_tests")
     @patch("devx.ci.release.create_and_push_tag", return_value=False)
@@ -525,6 +1175,8 @@ class TestMain:
         mock_tag: MagicMock,
         mock_run_tests: MagicMock,
         mock_user: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """When tag already exists, still update files but report existing tag."""
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
@@ -535,6 +1187,8 @@ class TestMain:
         mock_tag.assert_called_once_with("0.1.0", "changelog", False)
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.create_and_push_tag", return_value=True)
     @patch("devx.ci.release.commit_release_changes", return_value=True)
@@ -557,6 +1211,8 @@ class TestMain:
         mock_commit: MagicMock,
         mock_tag: MagicMock,
         mock_user: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """--skip-tests bypasses test verification."""
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
@@ -569,6 +1225,8 @@ class TestMain:
         assert make_calls == []
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.create_and_push_tag")
     @patch("devx.ci.release.commit_release_changes")
@@ -591,6 +1249,8 @@ class TestMain:
         mock_commit: MagicMock,
         mock_tag: MagicMock,
         mock_user: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """If tests fail, release aborts — no commit, no tag."""
         # Calls: git rev-parse (master), git log -1 (release lock check),
@@ -609,6 +1269,8 @@ class TestMain:
         mock_tag.assert_not_called()
 
     @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=[])
+    @patch("devx.ci.release.fetch_tags")
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.create_and_push_tag")
     @patch("devx.ci.release.commit_release_changes")
@@ -631,6 +1293,8 @@ class TestMain:
         mock_commit: MagicMock,
         mock_tag: MagicMock,
         mock_user: MagicMock,
+        mock_ft: MagicMock,
+        mock_vtc: MagicMock,
     ) -> None:
         """If lint fails, release aborts — no commit, no tag."""
         # Calls: git rev-parse (master), git log -1 (release lock check),
@@ -646,3 +1310,38 @@ class TestMain:
         assert "Lint failed" in result.output
         mock_commit.assert_not_called()
         mock_tag.assert_not_called()
+
+    @patch.dict("os.environ", {})
+    @patch("devx.ci.release.get_changelog_versions", return_value=[])
+    @patch("devx.ci.release.get_init_version", return_value="0.1.0")
+    @patch("devx.ci.release.get_all_tags", return_value=[])
+    @patch("devx.ci.release.get_latest_tag", return_value="")
+    @patch("devx.ci.release.run_cmd")
+    def test_verify_mode_no_tags(
+        self,
+        mock_run_cmd: MagicMock,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+    ) -> None:
+        """--verify checks alignment and exits without releasing."""
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        runner = CliRunner()
+        result = runner.invoke(main, ["--verify"])
+        assert result.exit_code == 0
+        assert "Release Alignment Verification" in result.output
+
+    @patch.dict("os.environ", {})
+    @patch("devx.ci.release.verify_tag_consistency", return_value=["  v0.1.0 → bad"])
+    @patch("devx.ci.release.fetch_tags")
+    @patch("devx.ci.release.run_cmd")
+    def test_preflight_tag_consistency_fails(
+        self, mock_run_cmd: MagicMock, mock_ft: MagicMock, mock_vtc: MagicMock
+    ) -> None:
+        """Pre-flight tag consistency check aborts if tags are misaligned."""
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code != 0
+        assert "Tag consistency check failed" in result.output

tests/unit/test_setup.py

@@ -1,5 +1,6 @@
 """Unit tests for devx.tools.setup."""
 
+import os
 import subprocess
 from pathlib import Path
 from unittest.mock import MagicMock, patch
@@ -32,20 +33,48 @@ class TestRun:
 
 
 class TestInstallPythonDeps:
-    @patch("devx.tools.setup._run")
+    @patch("devx.tools.setup.subprocess.run")
     def test_install_dev(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=0)
         _install_python_deps(".venv/bin", "dev")
-        mock_run.assert_called_once_with([".venv/bin/pip", "install", "-e", ".[dev]"])
+        mock_run.assert_called_once_with([".venv/bin/pip", "install", "-e", ".[dev]"], check=False)
 
-    @patch("devx.tools.setup._run")
+    @patch("devx.tools.setup.subprocess.run")
     def test_install_ci(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=0)
         _install_python_deps(".venv/bin", "ci")
-        mock_run.assert_called_once_with([".venv/bin/pip", "install", "-e", ".[ci]"])
+        mock_run.assert_called_once_with([".venv/bin/pip", "install", "-e", ".[ci]"], check=False)
+
+    @patch("devx.tools.setup.subprocess.run")
+    def test_install_custom_extras(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=0)
+        _install_python_deps(".venv/bin", "ci,lint")
+        mock_run.assert_called_once_with([".venv/bin/pip", "install", "-e", ".[ci,lint]"], check=False)
+
+    @patch("devx.tools.setup.subprocess.run")
+    def test_install_with_break_system_packages(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=0)
+        with patch.dict(os.environ, {"PIP_BREAK_SYSTEM_PACKAGES": "1"}):
+            _install_python_deps(".venv/bin", "ci")
+        mock_run.assert_called_once_with(
+            [".venv/bin/pip", "install", "-e", ".[ci]", "--break-system-packages"], check=False
+        )
 
     @patch("devx.tools.setup._run")
-    def test_install_custom_extras(self, mock_run: MagicMock) -> None:
-        _install_python_deps(".venv/bin", "ci,lint")
-        mock_run.assert_called_once_with([".venv/bin/pip", "install", "-e", ".[ci,lint]"])
+    @patch("devx.tools.setup.subprocess.run")
+    def test_install_retry_with_ignore_installed(self, mock_subprocess: MagicMock, mock_run: MagicMock) -> None:
+        mock_subprocess.return_value = MagicMock(returncode=1)
+        with patch.dict(os.environ, {"PIP_BREAK_SYSTEM_PACKAGES": "1"}):
+            _install_python_deps(".venv/bin", "ci")
+        mock_run.assert_called_once_with(
+            [".venv/bin/pip", "install", "-e", ".[ci]", "--break-system-packages", "--ignore-installed"]
+        )
+
+    @patch("devx.tools.setup.subprocess.run")
+    def test_install_failure_without_break_system(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=1)
+        with pytest.raises(subprocess.CalledProcessError):
+            _install_python_deps(".venv/bin", "ci")
 
 
 class TestInstallPreCommitHooks:
@@ -60,8 +89,9 @@ class TestInstallPreCommitHooks:
 
 
 class TestInstallAnsibleCollections:
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
     @patch("devx.tools.setup._run")
-    def test_installs_from_requirements(self, mock_run: MagicMock, tmp_path: Path) -> None:
+    def test_installs_from_requirements(self, mock_run: MagicMock, mock_which: MagicMock, tmp_path: Path) -> None:
         req = tmp_path / "ansible" / "requirements.yml"
         req.parent.mkdir(parents=True)
         req.write_text("collections: []")

tests/unit/test_start_docker.py

@@ -0,0 +1,278 @@
+"""Unit tests for devx.molecule.start_docker."""
+
+import os
+from unittest.mock import MagicMock, mock_open, patch
+
+from click.testing import CliRunner
+
+from devx.molecule.start_docker import (
+    DOCKER_SOCK,
+    _diagnose_socket,
+    is_docker_ready,
+    main,
+    start_docker_daemon,
+)
+
+
+class TestIsDockerReady:
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_ready(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=0)
+        with patch.dict("os.environ", {"DOCKER_HOST": f"unix://{DOCKER_SOCK}"}, clear=False):
+            assert is_docker_ready() is True
+        call_kwargs = mock_run.call_args
+        assert call_kwargs.args[0] == ["docker", "info"]
+        assert call_kwargs.kwargs["env"]["DOCKER_HOST"] == f"unix://{DOCKER_SOCK}"
+
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_not_ready(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=1)
+        assert is_docker_ready() is False
+
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_uses_docker_host_env(self, mock_run: MagicMock) -> None:
+        """Should check the socket specified by DOCKER_HOST env var."""
+        mock_run.return_value = MagicMock(returncode=0)
+        rootless = "unix:///run/user/999/docker.sock"
+        with patch.dict("os.environ", {"DOCKER_HOST": rootless}, clear=False):
+            assert is_docker_ready() is True
+        call_kwargs = mock_run.call_args
+        assert call_kwargs.kwargs["env"]["DOCKER_HOST"] == rootless
+
+
+class TestDiagnoseSocket:
+    @patch("devx.molecule.start_docker.os.stat")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_socket_exists(self, mock_run: MagicMock, mock_exists: MagicMock, mock_stat: MagicMock) -> None:
+        mock_stat.return_value = MagicMock(st_mode=0o660, st_uid=0, st_gid=0)
+        mock_run.side_effect = [
+            MagicMock(stdout="/dev/sda1 /var/lib/docker ext4\n", returncode=0, text=""),
+            MagicMock(stdout="default\n", returncode=0, text=""),
+            MagicMock(
+                stdout="Server Version: 29.5.2\nStorage Driver: overlay2\nDocker Root Dir: /var/lib/docker\n",
+                returncode=0,
+                text="",
+            ),
+        ]
+        _diagnose_socket()
+        mock_exists.assert_called_with(DOCKER_SOCK)
+
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_socket_missing(self, mock_run: MagicMock, mock_exists: MagicMock) -> None:
+        mock_run.side_effect = [
+            MagicMock(stdout="proc on /proc type proc\n", returncode=0, text=""),
+            MagicMock(stdout="default\n", returncode=0, text=""),
+            MagicMock(stdout="", stderr="Cannot connect", returncode=1, text=""),
+        ]
+        _diagnose_socket()
+        mock_exists.assert_called_with(DOCKER_SOCK)
+
+
+class TestStartDockerDaemon:
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    def test_host_socket_available(self, mock_ready: MagicMock, mock_diag: MagicMock) -> None:
+        """Should return immediately if host Docker is available."""
+        assert start_docker_daemon(timeout=5) is True
+        mock_ready.assert_called_once()
+        mock_diag.assert_called_once()
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    def test_rootless_socket_available(
+        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    ) -> None:
+        """Should use rootless socket if host socket fails."""
+        # First check (host) fails, second check (rootless) succeeds
+        mock_ready.side_effect = [False, True]
+        with patch("devx.molecule.start_docker.glob.glob", return_value=[]):
+            assert start_docker_daemon(timeout=5) is True
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    def test_alt_rootless_socket_found(
+        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    ) -> None:
+        """Should find rootless socket at a different UID via glob scan."""
+        # Host fails, own rootless fails, alt rootless succeeds
+        mock_ready.side_effect = [False, False, True]
+        alt_sock = "/run/user/999/docker.sock"
+        with patch("devx.molecule.start_docker.glob.glob", return_value=[alt_sock]):
+            assert start_docker_daemon(timeout=5) is True
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    def test_alt_rootless_socket_skips_own(
+        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    ) -> None:
+        """Should skip the own rootless socket in glob scan (already tried)."""
+        # Host fails, own rootless fails, alt rootless also fails, dockerd fails
+        mock_ready.side_effect = [False, False, False, False, False, False]
+        own_sock = f"/run/user/{os.getuid()}/docker.sock"
+        alt_sock = "/run/user/999/docker.sock"
+        with (
+            patch("devx.molecule.start_docker.glob.glob", return_value=[own_sock, alt_sock]),
+            patch("devx.molecule.start_docker.time.sleep"),
+            patch("devx.molecule.start_docker.subprocess.Popen"),
+            patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile") as mock_ntf,
+            patch("builtins.open", mock_open(read_data="err")),
+        ):
+            mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+            assert start_docker_daemon(timeout=2) is False
+
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
+    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    def test_starts_local_daemon(
+        self,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
+    ) -> None:
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        # Host fails, rootless doesn't exist, local daemon starts
+        mock_ready.side_effect = [False, False, False, False, True]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
+        popen_args = mock_popen.call_args.args[0]
+        assert "dockerd" in popen_args
+        assert "--storage-driver" in popen_args
+        assert "vfs" in popen_args
+        assert "-H" in popen_args
+
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
+    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    def test_fails_after_timeout(
+        self,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
+    ) -> None:
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        with patch("builtins.open", mock_open(read_data="dockerd error log")):
+            assert start_docker_daemon(timeout=3) is False
+        mock_popen.assert_called_once()
+        assert mock_sleep.call_count == 3
+
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
+    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    def test_fails_log_read_error(
+        self,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
+    ) -> None:
+        """Should handle log read errors gracefully."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        with patch("builtins.open", side_effect=OSError("permission denied")):
+            assert start_docker_daemon(timeout=2) is False
+
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    def test_local_daemon_ready_on_first_check(
+        self,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
+    ) -> None:
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        # Host fails, rootless doesn't exist, local ready on first loop check
+        mock_ready.side_effect = [False, False, True]
+        assert start_docker_daemon(timeout=5) is True
+        assert mock_popen.call_count == 1
+        assert mock_sleep.call_count == 1
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.environ")
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    def test_sets_docker_host(
+        self,
+        mock_ready: MagicMock,
+        mock_environ: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """DOCKER_HOST must be set so molecule connects to correct socket."""
+        start_docker_daemon(timeout=5)
+        mock_environ.__setitem__.assert_called_with("DOCKER_HOST", f"unix://{DOCKER_SOCK}")
+
+
+class TestMain:
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=True)
+    def test_success(self, mock_start: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0
+
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=False)
+    def test_failure(self, mock_start: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 1
+
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=True)
+    def test_custom_timeout_flag(self, mock_start: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, ["--timeout", "60"])
+        assert result.exit_code == 0
+        mock_start.assert_called_once_with(60)
+
+    @patch("devx.molecule.start_docker.os.environ.get")
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=True)
+    def test_exports_github_env(self, mock_start: MagicMock, mock_get: MagicMock) -> None:
+        """Should write DOCKER_HOST to GITHUB_ENV when available."""
+        mock_get.side_effect = lambda key, default="": (
+            "/tmp/github_env" if key == "GITHUB_ENV" else f"unix://{DOCKER_SOCK}" if key == "DOCKER_HOST" else default
+        )
+        with patch("builtins.open", mock_open()) as mock_file:
+            runner = CliRunner()
+            result = runner.invoke(main, [])
+            assert result.exit_code == 0
+            mock_file.assert_called_with("/tmp/github_env", "a")
+
+    @patch("devx.molecule.start_docker.os.environ.get", return_value="")
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=True)
+    def test_no_github_env(self, mock_start: MagicMock, mock_get: MagicMock) -> None:
+        """Should not crash when GITHUB_ENV is not set."""
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0

tests/unit/test_validate_commit_msg.py

@@ -152,6 +152,89 @@ class TestMain:
         assert "task ID" in result.output
 
 
+class TestCustomPrefix:
+    """Tests for custom task ID prefix (e.g., GRM-N instead of DEVX-N).
+
+    The prefix is configured via the DEVX_TASK_PREFIX environment variable.
+    This is critical for consumer projects like GRM that use their own
+    Vikunja project with a different identifier prefix.
+    """
+
+    def _write_msg(self, content: str) -> str:
+        fd, path = tempfile.mkstemp()
+        with os.fdopen(fd, "w") as f:
+            f.write(content)
+        return path
+
+    @patch.dict("os.environ", {"DEVX_TASK_PREFIX": "GRM"})
+    def test_master_accepts_grm_prefix(self) -> None:
+        """Master branch accepts GRM-N: prefix when DEVX_TASK_PREFIX=GRM."""
+        import importlib
+
+        import devx.ci.validate_commit_msg as vcm
+        import devx.config
+
+        importlib.reload(devx.config)
+        importlib.reload(vcm)
+        try:
+            msg_path = self._write_msg("GRM-66: fix: add scripts/** to infrastructure")
+            with patch("devx.ci.validate_commit_msg.get_branch", return_value="master"):
+                runner = CliRunner()
+                result = runner.invoke(vcm.main, [msg_path])
+                assert result.exit_code == 0
+            os.unlink(msg_path)
+        finally:
+            os.environ.pop("DEVX_TASK_PREFIX", None)
+            importlib.reload(devx.config)
+            importlib.reload(vcm)
+
+    @patch.dict("os.environ", {"DEVX_TASK_PREFIX": "GRM"})
+    def test_master_rejects_devx_prefix_when_grm_configured(self) -> None:
+        """Master branch rejects DEVX-N: prefix when DEVX_TASK_PREFIX=GRM."""
+        import importlib
+
+        import devx.ci.validate_commit_msg as vcm
+        import devx.config
+
+        importlib.reload(devx.config)
+        importlib.reload(vcm)
+        try:
+            msg_path = self._write_msg("DEVX-8: fix: wrong prefix")
+            with patch("devx.ci.validate_commit_msg.get_branch", return_value="master"):
+                runner = CliRunner()
+                result = runner.invoke(vcm.main, [msg_path])
+                assert result.exit_code == 1
+                assert "GRM-N" in result.output
+            os.unlink(msg_path)
+        finally:
+            os.environ.pop("DEVX_TASK_PREFIX", None)
+            importlib.reload(devx.config)
+            importlib.reload(vcm)
+
+    @patch.dict("os.environ", {"DEVX_TASK_PREFIX": "GRM"})
+    def test_feature_branch_rejects_grm_prefix(self) -> None:
+        """Feature branch rejects GRM-N: prefix when DEVX_TASK_PREFIX=GRM."""
+        import importlib
+
+        import devx.ci.validate_commit_msg as vcm
+        import devx.config
+
+        importlib.reload(devx.config)
+        importlib.reload(vcm)
+        try:
+            msg_path = self._write_msg("GRM-66: fix: should not have prefix on branch")
+            with patch("devx.ci.validate_commit_msg.get_branch", return_value="GRM-66-fix"):
+                runner = CliRunner()
+                result = runner.invoke(vcm.main, [msg_path])
+                assert result.exit_code == 1
+                assert "task ID" in result.output
+            os.unlink(msg_path)
+        finally:
+            os.environ.pop("DEVX_TASK_PREFIX", None)
+            importlib.reload(devx.config)
+            importlib.reload(vcm)
+
+
 def test_main_module_block() -> None:
     import tempfile