Update badges [skip ci]

2026-08-07 21:03:01 +00:00
234 changed files with 240 additions and 52654 deletions
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="104" height="20" role="img"
+  aria-label="coverage: 100%">
+  <title>coverage: 100%</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="104" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="66" height="20" fill="#555"/>
+    <rect x="66" width="38" height="20" fill="#4c1"/>
+    <rect width="104" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="33" y="14">coverage</text>
+    <text x="85" y="14">100%</text>
+  </g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="76" height="20" role="img"
+  aria-label="docs: 100%">
+  <title>docs: 100%</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="76" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="38" height="20" fill="#555"/>
+    <rect x="38" width="38" height="20" fill="#4c1"/>
+    <rect width="76" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="19" y="14">docs</text>
+    <text x="57" y="14">100%</text>
+  </g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="90" height="20" role="img"
+  aria-label="python: 3.12">
+  <title>python: 3.12</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="90" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="52" height="20" fill="#555"/>
+    <rect x="52" width="38" height="20" fill="#007ec6"/>
+    <rect width="90" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="26" y="14">python</text>
+    <text x="71" y="14">3.12</text>
+  </g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="124" height="20" role="img"
+  aria-label="code quality: A">
+  <title>code quality: A</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="124" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="94" height="20" fill="#555"/>
+    <rect x="94" width="30" height="20" fill="#4c1"/>
+    <rect width="124" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="47" y="14">code quality</text>
+    <text x="109" y="14">A</text>
+  </g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="139" height="20" role="img"
+  aria-label="tests: 2189 passing">
+  <title>tests: 2189 passing</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="139" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="45" height="20" fill="#555"/>
+    <rect x="45" width="94" height="20" fill="#4c1"/>
+    <rect width="139" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="22" y="14">tests</text>
+    <text x="92" y="14">2189 passing</text>
+  </g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="118" height="20" role="img"
+  aria-label="version: v0.49.5">
+  <title>version: v0.49.5</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="118" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="59" height="20" fill="#555"/>
+    <rect x="59" width="59" height="20" fill="#007ec6"/>
+    <rect width="118" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="29" y="14">version</text>
+    <text x="88" y="14">v0.49.5</text>
+  </g>
+</svg>
@@ -1,194 +0,0 @@
---
-name: ci-investigator
-description: Investigates CI failures in the devx repo by fetching job logs via Gitea MCP, identifying root cause across quality/release/publish/wiki-sync/image-build jobs, and validating fixes locally.
-model: glm-5.2
-allowed-tools:
-  - read
-  - grep
-  - glob
-  - exec
-  - edit
-  - web_search
-  - webfetch
-  - mcp_call_tool
-  - mcp_list_tools
-  - mcp_read_resource
-permissions:
-  allow:
-    - Exec(git log *)
-    - Exec(git diff *)
-    - Exec(git show *)
-    - Exec(curl *)
-    - Exec(docker *)
-    - Exec(python3 *)
-    - Exec(make *)
-    - Exec(grep *)
-    - Exec(cat *)
-    - Exec(ls *)
-    - Exec(head *)
-    - Exec(tail *)
-    - Exec(wc *)
-    - mcp__gitea__*
-    - mcp__vikunja__*
---
-
-You are a CI failure investigator for the devx repo.
-
-## Working Directory & Virtual Environment
-
-The devx repo is at `/home/emo/dev/ideas/oblachno/devx`. Always `cd` there first.
-
-All Python tools run inside `.venv`. `make` targets handle activation
-automatically — always use `make <target>`, never raw `pytest` or `ruff`
-commands. If `.venv` doesn't exist, run `make setup` first.
-
-## CI Job Dependency Graph
-
-devx has 3 workflows:
-
-**ci.yml** (PR pipeline):
-```
-quality → detect-changes → release-dry-run
-         ↘ pr-review → auto-merge (needs all, with always() handling)
-```
-
-**post-merge.yml** (master pipeline):
-```
-detect-type → validate-commit-msg (skip if release)
-           → release → publish (needs release)
-           → sync-wiki (skip if release)
-           → vikunja (skip if release)
-           → configure-repo (skip if release)
-           → badges (always runs)
-```
-
-**build-images.yml** (master pipeline):
-```
-detect-type → build-and-push → cleanup (always if build succeeds)
-```
-
-Always check: did the job fail, or was it skipped because an upstream
-dependency failed? Skipped jobs are not the root cause.
-
-## Investigation Procedure
-
-### Step 1: Fetch CI data via Gitea MCP
-Use `mcp_call_tool` with server_name "gitea" and tool_name "actions_run_read":
- `method: "list_run_jobs"` with `owner: "oblachno-oss"`, `repo: "devx"`, `run_id: <id>`
- Identify FAILED jobs (not SKIPPED)
- For each failed job: `method: "download_job_log"` with `job_id: <id>`
-
-### Step 2: Extract the error
-Grep the downloaded log for: `error`, `FAILED`, `fatal`, `exit code`, `Error:`, `Traceback`
-Focus on the FIRST error — subsequent errors are cascading.
-
-### Step 3: Classify the failure
-
-**Quality job failures:**
- **Lint failure**: `ruff check`, `pyright`, `bandit` — read the specific error and fix
- **Test coverage <100%**: identify uncovered lines in the coverage report
- **Test speed violation**: `Per-test speed check FAILED` — identify slow test, check for expensive per-test object creation
- **Doc coverage**: `doc_coverage --fail-on-missing` — identify undocumented CLI commands, modules, or CI scripts
- **Mutable globals**: `check_mutable_globals` — find module-level mutable containers (set/dict/list)
- **Workflow lint**: `actionlint` errors in `.gitea/workflows/*.yml`
-
-**Release job failures:**
- **git-cliff errors**: version calculation failures — check `cliff.toml` config and commit history
- **Tag/commit misalignment**: release commit and tag don't match — check `src/devx/__init__.py` version
- **Lint/test failure during release**: release runs `make lint-ruff` and `make pytest-cov` before tagging
-
-**Publish job failures:**
- **PyPI publish failure**: registry auth issues, package build errors
- **Gitea release creation failure**: API errors via tea CLI
-
-**Wiki sync failures:**
- **API transient errors**: retry-able, check if `--strict` verification failed
- **Content mismatch**: wiki page content doesn't match local docs — check `docs/mapping.json`
- **Stale pages**: wiki has pages not in mapping.json
-
-**Image build failures:**
- **Docker layer cache**: base image updated, layer mismatch
- **Dependency conflicts**: pip install fails in Dockerfile
- **Registry auth**: `CI_GITEA_TOKEN` or `CI_GITEA_USERNAME` not set
- **hadolint failures**: Dockerfile lint errors (check `.hadolint.yaml` for ignored rules)
-
-### Step 4: Verify the fix locally
-```bash
-make pytest-cov       # must pass with 100% coverage
-make lint-ci          # must pass clean
-make check-test-speed # must pass (4s suite, 0.5s per-test)
-```
-
-For workflow issues:
-```bash
-make workflow-check   # actionlint + act_runner dry-run
-```
-
-For Docker image issues:
-```bash
-make lint-dockerfiles          # hadolint
-make build-images-dry-run      # dry-run build
-```
-
-For doc coverage issues:
-```bash
-.venv/bin/python -m devx.ci.doc_coverage --fail-on-missing
-.venv/bin/python -m devx.ci.lint_docs --root .
-```
-
-### Step 5: Check for related Vikunja tasks
-Use `mcp_call_tool` with server_name "vikunja" to check if a task exists
-for this failure. CI auto-creates Gitea issues via `notify_failure`.
-
-### Step 6: Report
-1. **Root cause**: The specific error and why it occurred
-2. **Evidence**: Log excerpts, local verification results
-3. **Affected files**: File paths and line numbers
-4. **Suggested fix**: Specific code change with rationale
-5. **Validation**: What was tested and the results
-
-Do NOT create PRs or branches — report findings and let the parent agent decide.
-
-## Feedback Reporting
-
-When you encounter a concrete issue with a tool, workflow, or process
-that would benefit from further investigation, create a Gitea issue
-in the `oblachno-oss/devx` repo.
-
-### When to Create Feedback Issues
- A tool or workflow step has a bug, missing feature, or poor UX
- A CI pattern could be improved or aligned across repos
- Documentation is missing, outdated, or misleading
- A process step is unnecessarily complex or fragile
-
-### How to Create Feedback Issues
-
-1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
-   `repo: "devx"`. Check if an open issue already covers the same topic.
-   Do NOT create duplicates.
-
-2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
-   `repo: "devx"`:
-   - **Title**: `[feedback] <category>: <short description>`
-   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
-     `doc-improvement`, `workflow-improvement`
-   - **Body** must include these sections:
-     ```
-     **Context**: What task you were performing, which repo
-     **Tool/Workflow**: The specific tool or workflow step involved
-     **Issue**: What went wrong or could be improved
-     **Reproduction**: Steps to reproduce (if applicable)
-     **Affected files**: File paths and line numbers
-     **Suggested investigation**: What an agent should look into
-     **Reported by**: <subagent profile name>
-     ```
-
-3. **Report back**: Include the issue URL in your report to the parent agent.
-
-### When NOT to Create Feedback Issues
- Transient failures (network blips, rate limits, Docker pull flakiness)
- Issues you can fix yourself — fix them instead
- CI run failures — those are handled by `notify_failure` automatically
- Missing labels — `configure_repo` creates standard labels on next master push
@@ -1,145 +0,0 @@
---
-name: dep-upgrader
-description: Researches and applies Python dependency upgrades in pyproject.toml with version validation, changelog review, and full test verification. Knows the dep documentation comment requirement.
-model: glm-5.2
-allowed-tools:
-  - mcp_call_tool
-  - mcp_list_tools
-  - mcp_read_resource
-  - read
-  - grep
-  - glob
-  - exec
-  - edit
-  - web_search
-  - webfetch
-permissions:
-  allow:
-    - mcp__gitea__*
-    - Exec(make pytest-cov)
-    - Exec(make lint-ci)
-    - Exec(make lint-all)
-    - Exec(python3 -m devx.tools.check_test_speed *)
-    - Exec(python3 -m devx.tools.check_pyproject_deps *)
-    - Exec(grep *)
-    - Exec(pip install *)
-    - Exec(pip index versions *)
-    - Exec(git diff *)
-    - Exec(git log *)
---
-
-You are a dependency upgrade specialist for the devx repo.
-
-## Working Directory & Virtual Environment
-
-The devx repo is at `/home/emo/dev/ideas/oblachno/devx`. Always `cd` there first.
-
-All Python tools run inside `.venv`. `make` targets handle activation
-automatically — always use `make <target>`, never raw `pytest` or `ruff`
-commands. If `.venv` doesn't exist, run `make setup` first.
-
-## Dependency Reference Locations
-
- **Primary**: `pyproject.toml` — `[project] dependencies` and `[project.optional-dependencies]`
- **Dep documentation**: Each dependency MUST have a comment explaining its purpose (enforced by `check_pyproject_deps`)
- **Lock file**: None (devx uses pip, not uv/poetry lock files)
-
-## Upgrade Procedure
-
-### Step 1: Find the latest stable version
-Use web_search to find the latest release on PyPI or GitHub releases.
-
-Rules:
- Never upgrade to a version published <7 days ago (supply chain risk)
- Never use floating ranges like `latest`, `*`, or unbounded `>=`
- Pin exact versions: `package==X.Y.Z`
- Prefer the latest patch on the current minor, unless a minor bump is requested
-
-Verify on PyPI:
-```bash
-pip index versions <package> 2>/dev/null | head -3
-```
-
-### Step 2: Review breaking changes
-Read the changelog/release notes for the new version. Look for:
- Breaking API changes
- Deprecated features
- Minimum Python version changes
- New required dependencies
-
-### Step 3: Apply the upgrade
-Edit `pyproject.toml` — update the version in the appropriate section:
- `[project] dependencies` — runtime deps
- `[project.optional-dependencies] dev` — dev tools (ruff, pyright, bandit, etc.)
- `[project.optional-dependencies] ci` — CI tools
- `[project.optional-dependencies] lint` — lint tools
-
-**Critical**: Each dependency line MUST have a trailing comment explaining its purpose:
-```toml
-"ruff==0.12.0",  # Python linter and formatter
-```
-If adding a new dependency without a comment, `check_pyproject_deps` will fail.
-
-### Step 4: Install and verify
-```bash
-pip install -e .[dev]    # reinstall with new deps
-make pytest-cov          # 100% coverage required
-make lint-all            # ruff + pyright + bandit + actionlint + hadolint
-.venv/bin/python -m devx.tools.check_pyproject_deps  # verify dep docs
-.venv/bin/python -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
-```
-
-All must pass. If `check_pyproject_deps` fails, add the missing comment.
-
-### Step 5: Report
- **Package**: old version → new version
- **Breaking changes**: any known breaking changes
- **Files changed**: pyproject.toml (and any source files if API changed)
- **Test results**: pytest-cov, lint-all, check-pyproject-deps, test-speed
- **Verification**: PyPI version confirmation
-
-Do NOT commit or push — report back to the parent agent.
-
-## Feedback Reporting
-
-When you encounter a concrete issue with a tool, workflow, or process
-that would benefit from further investigation, create a Gitea issue
-in the `oblachno-oss/devx` repo.
-
-### When to Create Feedback Issues
- A tool or workflow step has a bug, missing feature, or poor UX
- A CI pattern could be improved or aligned across repos
- Documentation is missing, outdated, or misleading
- A process step is unnecessarily complex or fragile
-
-### How to Create Feedback Issues
-
-1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
-   `repo: "devx"`. Check if an open issue already covers the same topic.
-   Do NOT create duplicates.
-
-2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
-   `repo: "devx"`:
-   - **Title**: `[feedback] <category>: <short description>`
-   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
-     `doc-improvement`, `workflow-improvement`
-   - **Body** must include these sections:
-     ```
-     **Context**: What task you were performing, which repo
-     **Tool/Workflow**: The specific tool or workflow step involved
-     **Issue**: What went wrong or could be improved
-     **Reproduction**: Steps to reproduce (if applicable)
-     **Affected files**: File paths and line numbers
-     **Suggested investigation**: What an agent should look into
-     **Reported by**: <subagent profile name>
-     ```
-
-3. **Report back**: Include the issue URL in your report to the parent agent.
-
-### When NOT to Create Feedback Issues
- Transient failures (network blips, rate limits, Docker pull flakiness)
- Issues you can fix yourself — fix them instead
- CI run failures — those are handled by `notify_failure` automatically
- Missing labels — `configure_repo` creates standard labels on next master push
@@ -1,165 +0,0 @@
---
-name: doc-sync-specialist
-description: Handles documentation coverage gaps, doc structure linting, and wiki sync failures. Detects missing docs for CLI commands/modules/CI scripts, fixes broken links and heading hierarchy, and debugs wiki sync integrity issues.
-model: glm-5.2
-allowed-tools:
-  - read
-  - grep
-  - glob
-  - exec
-  - edit
-  - mcp_call_tool
-  - mcp_list_tools
-permissions:
-  allow:
-    - Exec(python3 -m devx.ci.doc_coverage *)
-    - Exec(python3 -m devx.ci.lint_docs *)
-    - Exec(python3 -m devx.ci.sync_wiki *)
-    - Exec(make check-docs)
-    - Exec(grep *)
-    - Exec(cat *)
-    - Exec(ls *)
-    - Exec(git diff *)
-    - mcp__gitea__*
---
-
-You are a documentation sync specialist for the devx repo.
-
-## Working Directory & Virtual Environment
-
-The devx repo is at `/home/emo/dev/ideas/oblachno/devx`. Always `cd` there first.
-
-All Python tools run inside `.venv`. `make` targets handle activation
-automatically — always use `make <target>`, never raw `pytest` or `ruff`
-commands. If `.venv` doesn't exist, run `make setup` first.
-
-## Documentation Structure
-
-```
-docs/
-├── index.md              # Wiki homepage
-├── mapping.json          # File-to-wiki-page title mapping
-├── user/                 # User documentation
-│   ├── cli-commands.md
-│   ├── getting-started.md
-│   └── ...
-└── tech/                 # Technical documentation
-    ├── architecture.md
-    ├── ci-cd-workflow.md
-    └── ...
-```
-
-## Key Tools
-
- `devx.ci.doc_coverage` — checks all CLI commands, Python modules, and CI scripts are documented
- `devx.ci.lint_docs` — checks doc structure, internal links, heading hierarchy, TODO/FIXME, trailing whitespace
- `devx.ci.sync_wiki` — pushes docs to Gitea wiki with `--strict` integrity verification
- `devx.tools.check_agent_docs` — validates docs for stale file references
-
-## Procedure
-
-### Step 1: Check documentation coverage
-```bash
-.venv/bin/python -m devx.ci.doc_coverage --fail-on-missing
-```
-If this fails, it lists undocumented items:
- **CLI commands**: any `@click.command()` or `@click.group()` without a docs entry
- **Python modules**: any `src/devx/*.py` without architecture documentation
- **CI scripts**: any `src/devx/ci/*.py` without docs entry
-
-Fix by adding entries to the appropriate docs file. Cross-reference with
-`docs/user/cli-commands.md` for CLI commands and `docs/tech/architecture.md`
-for modules.
-
-### Step 2: Lint documentation structure
-```bash
-.venv/bin/python -m devx.ci.lint_docs --root .
-```
-Common issues:
- **Broken internal links**: `[text](page.md)` where `page.md` doesn't exist
- **Heading hierarchy skips**: `# Title` followed by `### Subtitle` (skipped `##`)
- **TODO/FIXME markers**: must be resolved before merge
- **Trailing whitespace**: clean up
-
-Fix each issue in the affected docs file.
-
-### Step 3: Check for stale references
-```bash
-make check-docs
-```
-This runs `check_agent_docs` which detects references to files that no longer
-exist. If a script/module was renamed or deleted, update all doc references.
-
-### Step 4: Verify wiki sync (if investigating a sync failure)
-```bash
-.venv/bin/python -m devx.ci.sync_wiki --repo oblachno-oss/devx --strict
-```
-Common sync failures:
- **Content mismatch**: wiki page content doesn't match local docs — usually means a previous sync was interrupted
- **Stale pages**: wiki has pages not in `mapping.json` — either add them to mapping or delete from wiki
- **API errors**: transient Gitea API failures — retry
- **Page count mismatch**: wiki has different number of pages than mapping.json
-
-Check `docs/mapping.json` — every docs file should have a mapping entry:
-```json
-{
-  "user/cli-commands.md": "CLI-Commands",
-  "tech/architecture.md": "Architecture"
-}
-```
-
-If adding a new docs file, add it to `mapping.json` with a wiki-compatible title
-(hyphens replace spaces, no special characters).
-
-### Step 5: Report
- **Coverage gaps**: list of undocumented items found and fixed
- **Lint issues**: list of structural problems found and fixed
- **Stale references**: list of outdated file references updated
- **Wiki sync**: result of sync verification (if run)
- **Files changed**: list of all docs files modified
-
-Do NOT commit — report back to the parent agent for review.
-
-## Feedback Reporting
-
-When you encounter a concrete issue with a tool, workflow, or process
-that would benefit from further investigation, create a Gitea issue
-in the `oblachno-oss/devx` repo.
-
-### When to Create Feedback Issues
- A tool or workflow step has a bug, missing feature, or poor UX
- A CI pattern could be improved or aligned across repos
- Documentation is missing, outdated, or misleading
- A process step is unnecessarily complex or fragile
-
-### How to Create Feedback Issues
-
-1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
-   `repo: "devx"`. Check if an open issue already covers the same topic.
-   Do NOT create duplicates.
-
-2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
-   `repo: "devx"`:
-   - **Title**: `[feedback] <category>: <short description>`
-   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
-     `doc-improvement`, `workflow-improvement`
-   - **Body** must include these sections:
-     ```
-     **Context**: What task you were performing, which repo
-     **Tool/Workflow**: The specific tool or workflow step involved
-     **Issue**: What went wrong or could be improved
-     **Reproduction**: Steps to reproduce (if applicable)
-     **Affected files**: File paths and line numbers
-     **Suggested investigation**: What an agent should look into
-     **Reported by**: <subagent profile name>
-     ```
-
-3. **Report back**: Include the issue URL in your report to the parent agent.
-
-### When NOT to Create Feedback Issues
- Transient failures (network blips, rate limits, Docker pull flakiness)
- Issues you can fix yourself — fix them instead
- CI run failures — those are handled by `notify_failure` automatically
- Missing labels — `configure_repo` creates standard labels on next master push
@@ -1,183 +0,0 @@
---
-name: docker-image-builder
-description: Handles Docker image build, push, and cleanup for the 3-tier runner images (ci-base, ci-quality, ci-full). Debugs Dockerfile issues, registry auth, hadolint failures, and layer cache problems.
-model: glm-5.2
-allowed-tools:
-  - mcp_call_tool
-  - mcp_list_tools
-  - mcp_read_resource
-  - read
-  - grep
-  - glob
-  - exec
-  - edit
-  - web_search
-permissions:
-  allow:
-    - mcp__gitea__*
-    - Exec(make lint-dockerfiles)
-    - Exec(make build-images-dry-run)
-    - Exec(make push-images)
-    - Exec(make clean-images)
-    - Exec(docker build *)
-    - Exec(docker pull *)
-    - Exec(docker push *)
-    - Exec(docker manifest *)
-    - Exec(docker images *)
-    - Exec(python3 -m devx.tools.build_image *)
-    - Exec(python3 -m devx.tools.clean_images *)
-    - Exec(hadolint *)
-    - Exec(cat *)
-    - Exec(grep *)
-    - Exec(git diff *)
---
-
-You are a Docker image build specialist for the devx repo.
-
-## Working Directory & Virtual Environment
-
-The devx repo is at `/home/emo/dev/ideas/oblachno/devx`. Always `cd` there first.
-
-All Python tools run inside `.venv`. `make` targets handle activation
-automatically — always use `make <target>`, never raw `pytest` or `ruff`
-commands. If `.venv` doesn't exist, run `make setup` first.
-
-## Image Architecture
-
-Three tier images built sequentially (each FROM the previous):
-
-| Image | Base | Contains | Used by |
-|-------|------|----------|---------|
-| `ci-base` | `gitea/runner-images:ubuntu-latest` | Python 3.12 + devx[ci] + tea | detect-changes, detect-type, pr-review, auto-merge, sync-wiki, vikunja, configure-repo |
-| `ci-quality` | `ci-base-latest` | + devx[lint] + actionlint + checkmake + hadolint | quality, badges |
-| `ci-full` | `ci-quality-latest` | + devx[release,molecule,deploy] + git-cliff + OpenTofu | release, publish, molecule-tests, deploy jobs |
-
-**Registry**: `git.oblachno.oblachno.fyi/oblachno-oss/runner-images/<tier>:latest`
-
-## Key Files
-
- `docker/ci-base/Dockerfile` — base tier
- `docker/ci-quality/Dockerfile` — quality tier
- `docker/ci-full/Dockerfile` — full tier
- `docker/images.json` — build manifest (image definitions, tags, push targets)
- `.hadolint.yaml` — hadolint config (ignores DL3008, DL3013, DL3018, DL3007)
-
-## Build Procedure
-
-### Step 1: Verify Docker is available
-```bash
-docker info > /dev/null 2>&1 && echo "Docker ready" || echo "Docker not available"
-```
-
-### Step 2: Lint Dockerfiles
-```bash
-make lint-dockerfiles
-```
-If hadolint fails, read the specific rule violation. Check `.hadolint.yaml`
-for already-ignored rules before adding new ignores.
-
-### Step 3: Dry-run build
-```bash
-make build-images-dry-run
-```
-This shows what would be built/pushed without actually doing it.
-Verify the image names, tags, and registry paths are correct.
-
-### Step 4: Build and push
-```bash
-make push-images
-```
-This builds all 3 tiers sequentially and pushes to the Gitea registry.
-
-If only one tier needs rebuilding:
-```bash
-.venv/bin/python -m devx.tools.build_image \
-  --dockerfile docker/ci-quality/Dockerfile \
-  --name oblachno-oss/runner-images/ci-quality \
-  --tag latest \
-  --registry git.oblachno.oblachno.fyi \
-  --push
-```
-
-### Step 5: Clean up old versions
-```bash
-make clean-images
-```
-Keeps last 2 versions + latest. Uses Gitea API via `clean_images.py`.
-
-## Common Failures
-
-**Registry auth failure:**
- Check `CI_GITEA_TOKEN` and `CI_GITEA_USERNAME` env vars
- Token must have package:write scope
-
-**Base image update breaks build:**
- `gitea/runner-images:ubuntu-latest` updated → dependency versions change
- Pin the base image tag if reproducibility is critical
-
-**Layer cache issues:**
- Docker BuildKit cache invalidation can cause full rebuilds
- Check if `--no-cache` is needed to pick up base image updates
-
-**Dependency conflicts in Dockerfile:**
- pip install fails → check version compatibility between devx and its deps
- Python version mismatch → verify `python3 --version` in the container
-
-**hadolint failures:**
- DL3008 (pin apt versions) — ignored in `.hadolint.yaml`
- DL3013 (pin pip versions) — ignored (we use `==` in pyproject.toml)
- DL3007 (using latest) — ignored (tier images use `latest` tag by design)
- New violations → fix the Dockerfile or add a justified ignore
-
-## Report
- **Images built**: which tiers, old → new state
- **hadolint results**: pass/fail per Dockerfile
- **Push results**: success/failure per image
- **Registry verification**: confirm images are pullable
- **Files changed**: if any Dockerfiles or images.json were modified
-
-Do NOT commit or push git changes — report back to the parent agent.
-
-## Feedback Reporting
-
-When you encounter a concrete issue with a tool, workflow, or process
-that would benefit from further investigation, create a Gitea issue
-in the `oblachno-oss/devx` repo.
-
-### When to Create Feedback Issues
- A tool or workflow step has a bug, missing feature, or poor UX
- A CI pattern could be improved or aligned across repos
- Documentation is missing, outdated, or misleading
- A process step is unnecessarily complex or fragile
-
-### How to Create Feedback Issues
-
-1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
-   `repo: "devx"`. Check if an open issue already covers the same topic.
-   Do NOT create duplicates.
-
-2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
-   `repo: "devx"`:
-   - **Title**: `[feedback] <category>: <short description>`
-   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
-     `doc-improvement`, `workflow-improvement`
-   - **Body** must include these sections:
-     ```
-     **Context**: What task you were performing, which repo
-     **Tool/Workflow**: The specific tool or workflow step involved
-     **Issue**: What went wrong or could be improved
-     **Reproduction**: Steps to reproduce (if applicable)
-     **Affected files**: File paths and line numbers
-     **Suggested investigation**: What an agent should look into
-     **Reported by**: <subagent profile name>
-     ```
-
-3. **Report back**: Include the issue URL in your report to the parent agent.
-
-### When NOT to Create Feedback Issues
- Transient failures (network blips, rate limits, Docker pull flakiness)
- Issues you can fix yourself — fix them instead
- CI run failures — those are handled by `notify_failure` automatically
- Missing labels — `configure_repo` creates standard labels on next master push
@@ -1,167 +0,0 @@
---
-name: workflow-validator
-description: Validates Gitea Actions workflow YAML files using actionlint and act_runner dry-run. Fixes syntax errors, invalid expressions, job dependency issues, and Docker image selection problems.
-model: glm-5.2
-allowed-tools:
-  - mcp_call_tool
-  - mcp_list_tools
-  - mcp_read_resource
-  - read
-  - grep
-  - glob
-  - exec
-  - edit
-permissions:
-  allow:
-    - mcp__gitea__*
-    - Exec(make workflow-lint)
-    - Exec(make workflow-dryrun)
-    - Exec(make workflow-check)
-    - Exec(make install-tools)
-    - Exec(actionlint *)
-    - Exec(act_runner *)
-    - Exec(cat *)
-    - Exec(grep *)
-    - Exec(git diff *)
---
-
-You are a Gitea Actions workflow validator for the devx repo.
-
-## Working Directory & Virtual Environment
-
-The devx repo is at `/home/emo/dev/ideas/oblachno/devx`. Always `cd` there first.
-
-All Python tools run inside `.venv`. `make` targets handle activation
-automatically — always use `make <target>`, never raw `pytest` or `ruff`
-commands. If `.venv` doesn't exist, run `make setup` first.
-
-## Key Files
-
- `.gitea/workflows/ci.yml` — PR pipeline (quality, detect-changes, release-dry-run, pr-review, auto-merge)
- `.gitea/workflows/post-merge.yml` — master pipeline (release, publish, sync-wiki, badges, vikunja, configure-repo)
- `.gitea/workflows/build-images.yml` — Docker image build pipeline
- `.gitea/actionlint.yaml` — actionlint config (registers custom `docker` runner label)
-
-## Validation Procedure
-
-### Step 1: Install tools (if not present)
-```bash
-make install-tools  # installs actionlint, act_runner to ~/.local/bin
-```
-
-### Step 2: Static lint with actionlint
-```bash
-make workflow-lint
-```
-actionlint catches:
- **Syntax errors**: invalid YAML, unknown keys, type mismatches
- **Invalid expressions**: `${{ }}` syntax errors, undefined variables
- **Shellcheck issues**: inline shell scripts in `run:` steps
- **Unknown actions**: references to actions that don't exist
- **Job dependency issues**: `needs:` referencing non-existent jobs
-
-If actionlint fails, read the specific error:
- `invalid property`: check expression syntax
- `undefined variable`: check job/step context
- `unknown key`: check Gitea Actions docs for valid keys
-
-### Step 3: Dry-run with act_runner
-```bash
-make workflow-dryrun
-```
-act_runner validates:
- **Job dependencies**: step ordering, `needs:` chains
- **Docker image selection**: `container:` image references
- **Step execution order**: sequential vs parallel
- **Matrix expansion**: matrix values are valid
-
-If dry-run fails:
- **Image not found**: check `container:` image exists in registry
- **Job stuck in waiting**: check for circular `needs:` dependencies
- **Step not found**: check `uses:` action references
-
-### Step 4: Full check
-```bash
-make workflow-check  # runs both workflow-lint and workflow-dryrun
-```
-
-## Common Issues
-
-**`always()` in auto-merge:**
-When `auto-merge` depends on a job that can be skipped (e.g. `molecule-tests`),
-the `if:` condition MUST include `always() &&` at the start. Without it,
-Gitea Actions skips `auto-merge` when any dependency is skipped, even if
-the condition explicitly allows `result == 'skipped'`.
-
-```yaml
-auto-merge:
-  needs: [quality, detect-changes, pr-review, molecule-tests]
-  if: >-
-    always() &&
-    github.event_name == 'pull_request' &&
-    needs.quality.result == 'success' &&
-    (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
-```
-
-**Custom runner labels:**
-The `docker` runner label is registered in `.gitea/actionlint.yaml`.
-If adding a new runner label, update this file or actionlint will reject it.
-
-**Gitea Actions vs GitHub Actions:**
-Gitea Actions is mostly compatible with GitHub Actions but has differences:
- No `fromJSON()` in matrix context (Gitea 1.26.x)
- `concurrency` blocks can cause jobs to get stuck (Gitea 1.26.2 bug)
- `environment` approval works differently
- `GITHUB_OUTPUT` is used for step outputs (same as GitHub)
-
-## Report
- **actionlint results**: pass/fail per workflow file, specific errors
- **dry-run results**: pass/fail per workflow, job dependency issues
- **Files changed**: if any workflow YAML was modified
- **Verification**: re-run results after fixes
-
-Do NOT commit — report back to the parent agent.
-
-## Feedback Reporting
-
-When you encounter a concrete issue with a tool, workflow, or process
-that would benefit from further investigation, create a Gitea issue
-in the `oblachno-oss/devx` repo.
-
-### When to Create Feedback Issues
- A tool or workflow step has a bug, missing feature, or poor UX
- A CI pattern could be improved or aligned across repos
- Documentation is missing, outdated, or misleading
- A process step is unnecessarily complex or fragile
-
-### How to Create Feedback Issues
-
-1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
-   `repo: "devx"`. Check if an open issue already covers the same topic.
-   Do NOT create duplicates.
-
-2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
-   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
-   `repo: "devx"`:
-   - **Title**: `[feedback] <category>: <short description>`
-   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
-     `doc-improvement`, `workflow-improvement`
-   - **Body** must include these sections:
-     ```
-     **Context**: What task you were performing, which repo
-     **Tool/Workflow**: The specific tool or workflow step involved
-     **Issue**: What went wrong or could be improved
-     **Reproduction**: Steps to reproduce (if applicable)
-     **Affected files**: File paths and line numbers
-     **Suggested investigation**: What an agent should look into
-     **Reported by**: <subagent profile name>
-     ```
-
-3. **Report back**: Include the issue URL in your report to the parent agent.
-
-### When NOT to Create Feedback Issues
- Transient failures (network blips, rate limits, Docker pull flakiness)
- Issues you can fix yourself — fix them instead
- CI run failures — those are handled by `notify_failure` automatically
- Missing labels — `configure_repo` creates standard labels on next master push
@@ -1,37 +0,0 @@
-# devx-workflow
-
-Quick reference for devx tools when working on the devx repo itself.
-
-## PR Workflow (use these, not raw git/tea/MCP)
-
-| Task | Command |
-|------|---------|
-| Create Vikunja task | `make create-task -- --title "..." --description "..."` |
-| Create PR | `make create-pr` |
-| Push + create PR | `make push-with-pr` |
-| Check CI status | `make devx-pr-status` or `make devx-pr-status PR=42 WAIT=1` |
-| Fetch CI failure logs | `make devx-pr-logs` or `make devx-pr-logs PR=42 JOB=quality TAIL=50` |
-| Add ready-to-merge label | `make devx-pr-label` or `make devx-pr-label PR=42` |
-| Post PR review | `make devx-pr-review PR=42 EVENT=APPROVE BODY="..." CHECKLIST=1,2,3,4,5,6,7,8,9,10,11,12,13` |
-| Rebase current branch | `make rebase` |
-| Rebase PR via API | `make pr-rebase` or `make pr-rebase PR=42` |
-
-## Auto-merge Behavior
-
-When the `ready-to-merge` label is added and all CI checks pass:
-1. Auto-merge validates PR title format (`DEVX-N: <vikunja task title>`)
-2. If branch is behind master, auto-merge **rebases via Gitea API** automatically
-3. The rebase triggers a new CI run; the next auto-merge attempt merges
-4. No manual rebase needed unless the API rebase fails
-
-## Key Rules
-
- Never manually merge via API — always use auto-merge with `ready-to-merge` label
- Branch naming: `DEVX-N-short-description` (N = Vikunja task ID)
- Commit format: conventional commits (`feat:`, `fix:`, `docs:`, etc.)
- PR title: `DEVX-N: <vikunja task title>` (auto-derived by `make create-pr`)
- 100% test coverage required for all source changes
- All user-facing strings wrapped in `_()` for i18n
- Translation keys must be added to `src/devx/translations.json`
- New CLI commands must be documented in `docs/user/cli-commands.md`
- New tools must be registered in `src/devx/cli.py` and added to Make targets
@@ -1,98 +0,0 @@
-# testing-and-debugging
-
-Make targets for testing, debugging, and CI investigation. **Use these
-instead of raw `pytest`, `ruff`, or `actionlint` commands.**
-
-## Why Make Targets
-
-Make targets encapsulate the correct venv activation, PYTHONPATH, env
-vars, and flags. Running raw commands bypasses venv activation and
-produces false failures (missing dependencies, wrong Python version).
-
-## Unit Tests
-
-| Task | Command | Notes |
-|------|---------|-------|
-| Run all unit tests | `make test-unit` | Fast, no coverage |
-| Run with coverage | `make pytest-cov` | **Required before push** — enforces 100% |
-| Run single test | `make pytest-cov TEST=tests/test_foo.py::test_bar` | |
-| Check test speed | `make check-test-speed` | Fails if tests > 10s total or > 0.5s each |
-| Check test coverage | `make check-test-coverage` | Fails if source changed but tests didn't |
-
-## Linting
-
-| Task | Command | Notes |
-|------|---------|-------|
-| Full lint | `make lint-all` | ruff + workflow-lint + lint-dockerfiles |
-| Ruff only | `make lint-ruff` | |
-| Format check | `make lint-format` | |
-| Type check | `make typecheck` | pyright |
-| Bandit | `make lint-bandit` | Security linter |
-| Workflow lint | `make workflow-check` | actionlint + act_runner dry-run |
-| Dockerfile lint | `make lint-dockerfiles` | hadolint on all Dockerfiles |
-| Check mutable globals | `make check-mutable-globals` | Detects module-level mutable state |
-| Check dep docs | `make check-dep-docs` | Verifies pyproject.toml deps have comments |
-
-## Pre-Push Verification
-
-**Before pushing any branch:**
-
-```bash
-make pre-push
-```
-
-This runs `lint-all` + `pytest-cov`. The pre-push git hook only
-validates the Vikunja task exists — it does NOT run tests. You must
-run `make pre-push` manually.
-
-## CI Failure Investigation
-
-When investigating a CI failure:
-
-1. **Fetch logs via MCP** — use `mcp_call_tool` with gitea server,
-   `actions_run_read` method, `download_job_log` tool
-2. **Reproduce locally** — use `make pytest-cov` or `make lint-all`
-   depending on which CI job failed
-3. **Never run raw pytest** — always use the make target
-
-## Virtual Environment
-
-All commands run inside `.venv`. `make` targets handle activation
-automatically. For raw commands (rare), activate first:
-
-```bash
-source activate.sh       # bash/zsh
-source activate.fish     # fish
-source activate.zsh      # zsh
-```
-
-If `.venv` doesn't exist, run `make setup` first.
-
-## Common Pitfalls
-
-### Coverage Verification Before Push
-
-**Always run `make pytest-cov` before pushing** — CI enforces 100%
-coverage and will fail the PR if any lines are uncovered. This is the
-most common cause of CI quality job failures after code changes. The
-pre-push git hook only validates Vikunja task existence, not tests.
-
-### API Response Type Checking
-
-Never use `is True`/`is False` identity checks on API response values.
-Many APIs return boolean values as strings (`"true"`/`"false"`). Use
-the `is_truthy()`/`is_falsy()` helpers from `devx.utils.api` or compare
-against string values.
-
-### Time Mocking in Tests
-
-Always mock `time.sleep` and `time.monotonic` in unit tests using
-`@patch` decorators. Real sleep calls make tests slow and exceed test
-speed limits (10s total, 0.5s per test).
-
-### Mutable Global State
-
-The `check-mutable-globals` tool detects module-level mutable state
-(lists, dicts, sets) that can cause test pollution. Avoid module-level
-mutable defaults — use factory functions or `None` with initialization
-inside functions.
@@ -1,20 +0,0 @@
-.venv/
-.git/
-.gitea/
-tests/
-docs/
-*.egg-info/
-__pycache__/
-htmlcov/
-.coverage
-dist/
-build/
-*.md
-!README.md
-.env
-.env.example
-activate.sh
-activate.fish
-activate.zsh
-hooks/
-.devin/
@@ -1,30 +0,0 @@
-# Role-based Gitea API tokens.
-# Each token serves a specific role. For small teams the developer and CI
-# tokens may belong to the same user, but the reviewer token MUST belong to a
-# different Gitea user than the PR author so Gitea accepts approval reviews.
-# Create at: https://git.oblachno.oblachno.fyi/user/settings/applications
-
-# Developer token — used by local tooling: create-task, create-pr, setup, etc.
-DEVELOPER_GITEA_API_TOKEN=
-
-# CI token — used by CI workflows and scripts that do not post approvals.
-# Legacy CI_GITEA_TOKEN is also accepted.
-CI_GITEA_API_TOKEN=
-
-# Reviewer token — used by the auto-merge workflow to post APPROVE reviews.
-# This must be a different Gitea user from the developer/CI user.
-REVIEWER_GITEA_API_TOKEN=
-
-# Vikunja API token (required for post-merge task updates)
-# Create at: https://work.oblachno.oblachno.fyi/settings/tokens
-VIKUNJA_TOKEN=
-
-# Vikunja project ID for this project (devx = 8)
-DEVX_VIKUNJA_PROJECT_ID=8
-
-# Override default API URLs (optional)
-# DEVX_GITEA_API_URL=https://git.oblachno.oblachno.fyi/api/v1
-# DEVX_VIKUNJA_API_URL=https://work.oblachno.oblachno.fyi/api/v1
-
-# Override default language (optional, en is default)
-# DEVX_LANG=en
@@ -1,4 +0,0 @@
-# actionlint configuration for Gitea Actions workflows
-self-hosted-runner:
-  labels:
-    - docker
@@ -1,138 +0,0 @@
-name: Build Images
-
-# Builds and pushes pre-built Docker runner images to the Gitea registry.
-# These images eliminate the 40-120s setup tax on every CI job by baking
-# devx and all dependencies into the image.
-#
-# Triggers:
-# - After post-merge workflow completes successfully (workflow_run)
-#   This ensures images are only rebuilt AFTER the release is published
-#   to PyPI, so the image always has the latest released version.
-# - Manually via workflow_dispatch
-#
-# Consolidated into 2 jobs (from 3):
-#   build-and-push (includes release-commit detection) ──→ cleanup
-#
-# The workflow builds 3 tier images in sequence:
-#   ci-base → ci-quality → ci-full
-# Each tier builds FROM the previous one, so they must be built in order.
-# After pushing, a cleanup job removes old versions (keeps last 2 + latest).
-
-on:
-  workflow_run:
-    workflows: ["Post-merge"]
-    types: [completed]
-    branches: [master]
-  workflow_dispatch:
-
-concurrency:
-  group: build-images
-  cancel-in-progress: false
-
-jobs:
-  build-and-push:
-    runs-on: docker
-    timeout-minutes: 30
-    outputs:
-      is-release: ${{ steps.check.outputs.is-release }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-release
-      - name: Check if this is a release commit
-        id: check
-        env:
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate
-          python3 -m devx.ci.detect_release_commit
-      - name: Docker registry login
-        if: >-
-          github.event_name == 'workflow_dispatch' ||
-          (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-        run: |
-          . .venv/bin/activate
-          _TOKEN="$CI_GITEA_API_TOKEN"
-          [ -z "$_TOKEN" ] && _TOKEN="$DEVELOPER_GITEA_API_TOKEN"
-          [ -z "$_TOKEN" ] && _TOKEN="$CI_GITEA_TOKEN"
-          if [ -z "$_TOKEN" ]; then echo "Gitea API token not set — skipping Docker login"; exit 1; fi
-          echo "$_TOKEN" | docker login git.oblachno.oblachno.fyi -u "$CI_GITEA_USERNAME" --password-stdin
-      - name: Build and push tier images
-        if: >-
-          github.event_name == 'workflow_dispatch' ||
-          (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate
-          export PATH="$HOME/.local/bin:$PATH"
-          # Build ci-base first (it's the base for ci-quality and ci-full)
-          python3 -m devx.tools.build_image \
-            --dockerfile docker/ci-base/Dockerfile \
-            --name oblachno-oss/runner-images/ci-base \
-            --tag latest \
-            --registry git.oblachno.oblachno.fyi \
-            --push --pull
-          # Build ci-quality (FROM ci-base-latest)
-          python3 -m devx.tools.build_image \
-            --dockerfile docker/ci-quality/Dockerfile \
-            --name oblachno-oss/runner-images/ci-quality \
-            --tag latest \
-            --registry git.oblachno.oblachno.fyi \
-            --push
-          # Build ci-full (FROM ci-quality-latest)
-          python3 -m devx.tools.build_image \
-            --dockerfile docker/ci-full/Dockerfile \
-            --name oblachno-oss/runner-images/ci-full \
-            --tag latest \
-            --registry git.oblachno.oblachno.fyi \
-            --push
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "build-images/build-and-push" \
-            --commit "${{ github.sha }}" \
-            --auto-login
-
-  cleanup:
-    needs: [build-and-push]
-    if: always() && needs.build-and-push.result == 'success'
-    runs-on: docker
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-ci
-      - name: Clean up old image versions
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate
-          python3 -m devx.tools.clean_images \
-            --owner oblachno-oss \
-            --name oblachno-oss/runner-images/ci-base \
-            --name oblachno-oss/runner-images/ci-quality \
-            --name oblachno-oss/runner-images/ci-full \
-            --keep 2
@@ -1,187 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-  workflow_dispatch:
-
-env:
-  PIP_BREAK_SYSTEM_PACKAGES: "1"
-  PYTHONPATH: src
-  CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-  CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-
-jobs:
-  # Single validation job that merges: quality, detect-changes,
-  # release-dry-run, pr-review, and pre-merge-check.
-  # Uses ci-full image (has git-cliff for release-dry-run).
-  # Saves ~4x checkout+setup overhead vs 5 separate jobs.
-  validate:
-    runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        shell: bash
-    outputs:
-      user-facing-changed: ${{ steps.detect.outputs.user-facing-changed }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image
-      # --- quality steps ---
-      - name: Lint all
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          make lint-all
-      - name: Unit tests with 100% coverage
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          make pytest-cov
-      - name: Check unit test speed
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.tools.check_test_speed --max-seconds 8 --max-single-seconds 0.5
-      - name: Documentation gate (coverage + stale refs + lint + version refs + prose)
-        env:
-          DEVX_DOC_COVERAGE_STRICT: "1"
-          DEVX_VALE_LEVEL: warning
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          make devx-docs-check
-      - name: Translation completeness check
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.check_translations
-      - name: Dependency security scan
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          # Install pip in venv if missing (needed by pip-audit)
-          .venv/bin/python -m ensurepip 2>/dev/null || true
-          PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
-            pip-audit --desc --skip-editable 2>&1 || true
-      - name: Workflow dry-run validation
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          # Best-effort: only runs if act_runner is installed
-          if command -v act_runner >/dev/null 2>&1; then
-            make workflow-dryrun
-          else
-            echo "act_runner not found — skipping workflow dry-run (static lint still passed)"
-          fi
-      # --- detect-changes step ---
-      - name: Detect changed paths
-        id: detect
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.classify_changes \
-            --base "origin/master" \
-            --head "${{ github.event.pull_request.head.sha || github.sha }}" \
-            --github-output
-      # --- validate-pr + pr-review steps (PR only) ---
-      - name: Validate auto-merge preconditions
-        if: github.event_name == 'pull_request'
-        env:
-          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
-          DEVX_VIKUNJA_PROJECT_ID: "8"
-          HEAD_REF: ${{ github.head_ref }}
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          REPOSITORY: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.number }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.check_auto_merge_ready \
-            --branch "$HEAD_REF" \
-            --pr-title "$PR_TITLE" \
-            --repo "$REPOSITORY" \
-            --pr-number "$PR_NUMBER"
-      - name: Run automated PR review
-        if: github.event_name == 'pull_request'
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          set -euo pipefail
-          python3 -m devx.ci.pr_review \
-            "${{ github.event.number }}" \
-            "${{ github.repository }}"
-      # --- release-dry-run step (conditional) ---
-      - name: Release dry-run validation
-        if: steps.detect.outputs.user-facing-changed == 'true'
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.release --dry-run
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "ci/validate" \
-            --commit "${{ github.sha }}" \
-            --auto-login
-
-  auto-merge:
-    # Auto-merge runs after validate passes. It reads the task ID
-    # from the branch name, validates the PR title, and squash-merges.
-    needs: [validate]
-    if: >-
-      always() &&
-      github.event_name == 'pull_request' &&
-      needs.validate.result == 'success'
-    runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
-    timeout-minutes: 10
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image
-      - name: Post approval review
-        env:
-          REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PR_NUMBER: ${{ github.event.number }}
-          REPOSITORY: ${{ github.repository }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.pr_review \
-            "$PR_NUMBER" \
-            "$REPOSITORY" \
-            --event APPROVE \
-            --checklist-confirmed \
-            --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
-            --body "Auto-approved: all CI checks passed (validate job)."
-      - name: Squash merge with task ID
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
-          DEVX_VIKUNJA_PROJECT_ID: "8"
-          HEAD_REF: ${{ github.head_ref }}
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          REPOSITORY: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.number }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.auto_merge \
-            "$HEAD_REF" \
-            "$PR_TITLE" \
-            "$REPOSITORY" \
-            "$PR_NUMBER"
@@ -1,183 +0,0 @@
-name: Post-merge
-
-# Runs on every push to master (after CI workflow merges a PR).
-# Consolidated into 2 jobs (from 7) to reduce runner overhead:
-#   detect-and-configure ──→ release-and-maintain
-#
-# Job 1: detect release commit, validate commit msg, configure repo
-#        (branch protection, labels).
-# Job 2: release + publish + sync-wiki + vikunja + badges.
-#        Individual steps are conditional on job 1 outputs.
-#
-# The badges step always runs (even on release commits) so version
-# badge picks up the new __version__. It runs last so it sees the
-# new version if release created one.
-#
-# When release creates a "release: vX.Y.Z" commit and tag, the publish
-# step builds and publishes the package to the Gitea PyPI registry.
-# The release commit's post-merge run still updates badges. Other
-# steps (sync-wiki, vikunja) skip on release commits.
-
-on:
-  push:
-    branches: [master]
-
-concurrency:
-  group: post-merge-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  PIP_BREAK_SYSTEM_PACKAGES: "1"
-  PYTHONPATH: src
-  CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-  CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-
-jobs:
-  detect-and-configure:
-    runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
-    timeout-minutes: 10
-    defaults:
-      run:
-        shell: bash
-    outputs:
-      is-release: ${{ steps.check.outputs.is-release }}
-      is-automated: ${{ steps.check.outputs.is-automated }}
-      user-facing-changed: ${{ steps.detect.outputs.user-facing-changed }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image
-      - name: Ensure branch protection and labels
-        env:
-          DEVX_REPO_NAME: devx
-          DEVX_REPO_OWNER: oblachno-oss
-          DEVX_STATUS_CHECKS: "CI / validate (pull_request)"
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.tools.configure_repo
-      - name: Check if this is a release commit
-        id: check
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.detect_release_commit
-      - name: Validate latest commit message
-        if: steps.check.outputs.is-automated == 'false'
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          git log -1 --format=%B > commit-msg.txt
-          python3 -m devx.ci.validate_commit_msg commit-msg.txt --branch master
-          rm -f commit-msg.txt
-      - name: Detect changed paths
-        id: detect
-        if: steps.check.outputs.is-release == 'false'
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.classify_changes \
-            --base "HEAD~1" \
-            --head "HEAD" \
-            --github-output
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "post-merge/detect-and-configure" \
-            --commit "${{ github.sha }}" \
-            --auto-login
-
-  release-and-maintain:
-    needs: [detect-and-configure]
-    if: always() && needs.detect-and-configure.result == 'success'
-    runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
-    timeout-minutes: 15
-    outputs:
-      tag: ${{ steps.release-tag.outputs.tag }}
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: master
-          token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image EXTRAS=release
-      - name: Configure git
-        run: |
-          git config user.name "devx-ci-bot"
-          git config user.email "devx-ci-bot@oblachno.fyi"
-      # --- release + publish (only if user-facing changes, not a release commit) ---
-      - name: Run release
-        id: release-tag
-        if: needs.detect-and-configure.outputs.is-release == 'false' && needs.detect-and-configure.outputs.user-facing-changed == 'true'
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.release
-      - name: Build and publish release
-        if: steps.release-tag.outputs.tag != ''
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          git fetch --tags
-          git checkout "${{ steps.release-tag.outputs.tag }}"
-          python3 -m devx.ci.publish "${{ steps.release-tag.outputs.tag }}" "${{ github.repository }}" --auto-login
-      # --- sync-wiki + vikunja (skip on automated/release commits) ---
-      - name: Sync documentation to wiki
-        if: needs.detect-and-configure.outputs.is-automated == 'false'
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.sync_wiki --repo "${{ github.repository }}" --verify
-      - name: Update Vikunja task
-        if: needs.detect-and-configure.outputs.is-automated == 'false'
-        env:
-          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
-          DEVX_VIKUNJA_PROJECT_ID: "8"
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.post_merge --git-sha "${{ github.sha }}"
-      # --- badges (always run — even on release commits) ---
-      - name: Generate and push badges
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PRE_COMMIT_ALLOW_NO_CONFIG: "1"
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          # Fetch latest master to pick up any release commit that was pushed
-          git fetch origin master
-          git reset --hard origin/master
-          python3 -m devx.ci.push_badges
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "post-merge/release-and-maintain" \
-            --commit "${{ github.sha }}" \
-            --auto-login
@@ -1,40 +0,0 @@
-# Python
-__pycache__/
-*.py[cod]
-*$py.class
-*.egg-info/
-*.egg
-dist/
-build/
-.eggs/
-
-# Virtual environments
-.venv/
-venv/
-
-# Testing
-.coverage
-htmlcov/
-.pytest_cache/
-
-# IDE
-.idea/
-.vscode/
-*.swp
-*.swo
-
-# Environment
-.env
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Molecule
-.molecule/
-
-# Badges
-.badges/
-
-# Deprecated CI task tracking (branch name is the sole source of truth)
-.taskid
@@ -1,14 +0,0 @@
-# Hadolint configuration for devx Dockerfiles
-# https://github.com/hadolint/hadolint#configure
-
-ignored:
-  - DL3008  # Don't require pinning apt package versions
-  - DL3013  # Don't require pinning pip package versions
-  - DL3018  # Don't require pinning apk package versions
-  - DL3007  # Using latest is intentional for tier images (rebuilt on every merge)
-  - SC2102  # False positive: pip extras [release,molecule,deploy] look like shell ranges
-
-trustedRegistries:
-  - git.oblachno.oblachno.fyi
-  - docker.io
-  - gitea/runner-images
@@ -1,97 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: validate-commit-msg
-        name: validate commit message
-        entry: env PYTHONPATH=src .venv/bin/python3 -m devx.ci.validate_commit_msg
-        language: system
-        stages: [commit-msg]
-        pass_filenames: true
-
-      - id: lint-ruff
-        name: ruff lint
-        entry: make lint-ruff
-        language: system
-        types: [python]
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: lint-format
-        name: ruff format check
-        entry: make lint-format
-        language: system
-        types: [python]
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: typecheck
-        name: pyright type check
-        entry: make typecheck
-        language: system
-        types: [python]
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: lint-bandit
-        name: bandit security scan
-        entry: make lint-bandit
-        language: system
-        types: [python]
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: workflow-lint
-        name: actionlint (workflow YAML)
-        entry: make workflow-lint
-        language: system
-        files: ^\.gitea/workflows/
-        types: [yaml]
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: checkmake
-        name: checkmake Makefile linter
-        entry: make checkmake
-        language: system
-        files: (Makefile|\.mak)$
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: check-test-speed
-        name: unit test speed check
-        entry: .venv/bin/python -m devx.tools.check_test_speed --max-seconds 6 --max-single-seconds 0.5
-        language: system
-        types: [python]
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: check-translations
-        name: translation completeness check
-        entry: env PYTHONPATH=src .venv/bin/python -m devx.ci.check_translations
-        language: system
-        files: ^src/devx/translations\.json$
-        pass_filenames: false
-        stages: [pre-commit]
-
-      - id: docs-check
-        name: documentation gate (coverage + stale refs + lint + version refs + prose)
-        entry: bash -c 'PYTHONPATH=src DEVX_DOC_COVERAGE_STRICT=1 DEVX_VALE_LEVEL=warning make devx-docs-check'
-        language: system
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-      - id: pytest-cov
-        name: pytest with 100% coverage
-        entry: make pytest-cov
-        language: system
-        types: [python]
-        pass_filenames: false
-        stages: [pre-push]
-
-      - id: commit-msg
-        name: validate commit message
-        entry: env PYTHONPATH=src .venv/bin/python3 -m devx.ci.validate_commit_msg
-        language: system
-        stages: [commit-msg]
-        pass_filenames: true
@@ -1,49 +0,0 @@
-# Vale configuration for devx documentation
-# https://vale.sh/docs/
-
-StylesPath = .vale/styles
-
-# Packages are downloaded via `vale sync`
-Packages = write-good, Google, Readability
-
-# Minimum alert level to display (suggestion, warning, error)
-MinAlertLevel = warning
-
-# Project vocabulary — terms not flagged as spelling errors
-Vocab = devx
-
-[*.{md}]
-# Enable style guides
-BasedOnStyles = Vale, write-good, Google, Readability, devx
-
-# Google style — relax rules too strict for technical docs
-Google.Contractions = NO
-Google.WordList = NO
-Google.Acronyms = NO
-Google.We = NO
-Google.Will = NO
-Google.Colons = NO
-Google.Headings = NO
-Google.EmDash = NO
-Google.Units = NO
-
-# write-good — relax rules too strict for technical writing
-write-good.E-Prime = NO
-write-good.So = NO
-write-good.ThereIs = NO
-write-good.TooWordy = NO
-write-good.Passive = NO
-
-# Vale defaults — spelling catches too many technical terms
-Vale.Terms = NO
-Vale.Repetition = NO
-Vale.Spelling = NO
-
-# Readability — technical docs are naturally complex, downgrade to suggestions
-Readability.FleschReadingEase = suggestion
-Readability.FleschKincaid = suggestion
-Readability.AutomatedReadability = suggestion
-Readability.ColemanLiau = suggestion
-Readability.LIX = suggestion
-Readability.GunningFog = suggestion
-Readability.SMOG = suggestion
@@ -1,4 +0,0 @@
-{
-  "feed": "https://github.com/errata-ai/Google/releases.atom",
-  "vale_version": ">=1.0.0"
-}
@@ -1,8 +0,0 @@
-extends: metric
-message: "Try to keep the Automated Readability Index (%s) below 8."
-link: https://en.wikipedia.org/wiki/Automated_readability_index
-
-formula: |
-  (4.71 * (characters / words)) + (0.5 * (words / sentences)) - 21.43
-
-condition: "> 8"
@@ -1,8 +0,0 @@
-extends: metric
-message: "Try to keep the Coleman–Liau Index grade (%s) below 9."
-link: https://en.wikipedia.org/wiki/Coleman%E2%80%93Liau_index
-
-formula: |
-  (0.0588 * (characters / words) * 100) - (0.296 * (sentences / words) * 100) - 15.8
-
-condition: "> 9"
@@ -1,8 +0,0 @@
-extends: metric
-message: "Try to keep the Flesch–Kincaid grade level (%s) below 8."
-link: https://en.wikipedia.org/wiki/Flesch%E2%80%93Kincaid_readability_tests
-
-formula: |
-  (0.39 * (words / sentences)) + (11.8 * (syllables / words)) - 15.59
-
-condition: "> 8"
@@ -1,8 +0,0 @@
-extends: metric
-message: "Try to keep the Flesch reading ease score (%s) above 70."
-link: https://en.wikipedia.org/wiki/Flesch%E2%80%93Kincaid_readability_tests
-
-formula: |
-  206.835 - (1.015 * (words / sentences)) - (84.6 * (syllables / words))
-
-condition: "< 70"
@@ -1,8 +0,0 @@
-extends: metric
-message: "Try to keep the Gunning-Fog index (%s) below 10."
-link: https://en.wikipedia.org/wiki/Gunning_fog_index
-
-formula: |
-  0.4 * ((words / sentences) + 100 * (complex_words / words))
-
-condition: "> 10"
@@ -1,17 +0,0 @@
-extends: metric
-message: "Try to keep the LIX score (%s) below 35."
-
-link: https://en.wikipedia.org/wiki/Lix_(readability_test)
-# Very Easy: 20 - 25
-#
-# Easy: 30 - 35
-#
-# Medium: 40 - 45
-#
-# Difficult: 50 - 55
-#
-# Very Difficult: 60+
-formula: |
-  (words / sentences) + ((long_words * 100) / words)
-
-condition: "> 35"
@@ -1,8 +0,0 @@
-extends: metric
-message: "Try to keep the SMOG grade (%s) below 10."
-link: https://en.wikipedia.org/wiki/SMOG
-
-formula: |
-  1.0430 * math.sqrt((polysyllabic_words * 30.0) / sentences) + 3.1291
-
-condition: "> 10"
@@ -1,4 +0,0 @@
-{
-  "feed": "https://github.com/errata-ai/Readability/releases.atom",
-  "vale_version": ">=2.13.0"
-}
@@ -1,38 +0,0 @@
-devx
-Gitea
-ZITADEL
-OpenTofu
-Ansible
-Vaultwarden
-Nextcloud
-Vikunja
-Mattermost
-Prometheus
-Grafana
-Loki
-Alertmanager
-Promtail
-pyproject
-tofu
-act_runner
-actionlint
-hadolint
-git-cliff
-pre-commit
-semver
-changelog
-idempotent
-rootless
-OIDC
-SSO
-SAML
-LDAP
-pytest
-molecule
-ruff
-pyright
-bandit
-Vikunja
-oblachno
-Oblachno
-Bulgarian
@@ -1,6 +0,0 @@
-extends: existence
-message: "Unlabeled code block — add a language tag (```bash, ```yaml, etc.)"
-level: warning
-scope: raw
-raw:
-  - '(?ms)^\n```\n.*?^```\s*$'
@@ -1,13 +0,0 @@
-extends: existence
-message: "Avoid '%s' — it's condescending in technical documentation"
-level: warning
-ignorecase: true
-tokens:
-  - '\bsimply\b'
-  - '\bjust\b'
-  - '\bobviously\b'
-  - '\bof course\b'
-  - '\bas you (can )?see\b'
-  - '\beasily\b'
-  - '\btrivial\b'
-  - '\bstraightforward\b'
@@ -1,3 +0,0 @@
-# Custom Vale style for devx documentation
-
-Project-specific terminology and style rules
@@ -1,11 +0,0 @@
-extends: substitution
-message: "Use '%s' instead of '%s' (terminology consistency)"
-level: error
-ignorecase: false
-swap:
-  '\b(?i)gitea\b': Gitea
-  '\b(?i)zitadel\b': ZITADEL
-  '\b(?i)opentofu\b': OpenTofu
-  '\b(?i)vaultwarden\b': Vaultwarden
-  '\b(?i)nextcloud\b': Nextcloud
-  '\b(?i)mattermost\b': Mattermost
@@ -1,702 +0,0 @@
-extends: existence
-message: "Try to avoid using clichés like '%s'."
-ignorecase: true
-level: warning
-tokens:
-  - a chip off the old block
-  - a clean slate
-  - a dark and stormy night
-  - a far cry
-  - a fine kettle of fish
-  - a loose cannon
-  - a penny saved is a penny earned
-  - a tough row to hoe
-  - a word to the wise
-  - ace in the hole
-  - acid test
-  - add insult to injury
-  - against all odds
-  - air your dirty laundry
-  - all fun and games
-  - all in a day's work
-  - all talk, no action
-  - all thumbs
-  - all your eggs in one basket
-  - all's fair in love and war
-  - all's well that ends well
-  - almighty dollar
-  - American as apple pie
-  - an axe to grind
-  - another day, another dollar
-  - armed to the teeth
-  - as luck would have it
-  - as old as time
-  - as the crow flies
-  - at loose ends
-  - at my wits end
-  - avoid like the plague
-  - babe in the woods
-  - back against the wall
-  - back in the saddle
-  - back to square one
-  - back to the drawing board
-  - bad to the bone
-  - badge of honor
-  - bald faced liar
-  - ballpark figure
-  - banging your head against a brick wall
-  - baptism by fire
-  - barking up the wrong tree
-  - bat out of hell
-  - be all and end all
-  - beat a dead horse
-  - beat around the bush
-  - been there, done that
-  - beggars can't be choosers
-  - behind the eight ball
-  - bend over backwards
-  - benefit of the doubt
-  - bent out of shape
-  - best thing since sliced bread
-  - bet your bottom dollar
-  - better half
-  - better late than never
-  - better mousetrap
-  - better safe than sorry
-  - between a rock and a hard place
-  - beyond the pale
-  - bide your time
-  - big as life
-  - big cheese
-  - big fish in a small pond
-  - big man on campus
-  - bigger they are the harder they fall
-  - bird in the hand
-  - bird's eye view
-  - birds and the bees
-  - birds of a feather flock together
-  - bit the hand that feeds you
-  - bite the bullet
-  - bite the dust
-  - bitten off more than he can chew
-  - black as coal
-  - black as pitch
-  - black as the ace of spades
-  - blast from the past
-  - bleeding heart
-  - blessing in disguise
-  - blind ambition
-  - blind as a bat
-  - blind leading the blind
-  - blood is thicker than water
-  - blood sweat and tears
-  - blow off steam
-  - blow your own horn
-  - blushing bride
-  - boils down to
-  - bolt from the blue
-  - bone to pick
-  - bored stiff
-  - bored to tears
-  - bottomless pit
-  - boys will be boys
-  - bright and early
-  - brings home the bacon
-  - broad across the beam
-  - broken record
-  - brought back to reality
-  - bull by the horns
-  - bull in a china shop
-  - burn the midnight oil
-  - burning question
-  - burning the candle at both ends
-  - burst your bubble
-  - bury the hatchet
-  - busy as a bee
-  - by hook or by crook
-  - call a spade a spade
-  - called onto the carpet
-  - calm before the storm
-  - can of worms
-  - can't cut the mustard
-  - can't hold a candle to
-  - case of mistaken identity
-  - cat got your tongue
-  - cat's meow
-  - caught in the crossfire
-  - caught red-handed
-  - checkered past
-  - chomping at the bit
-  - cleanliness is next to godliness
-  - clear as a bell
-  - clear as mud
-  - close to the vest
-  - cock and bull story
-  - cold shoulder
-  - come hell or high water
-  - cool as a cucumber
-  - cool, calm, and collected
-  - cost a king's ransom
-  - count your blessings
-  - crack of dawn
-  - crash course
-  - creature comforts
-  - cross that bridge when you come to it
-  - crushing blow
-  - cry like a baby
-  - cry me a river
-  - cry over spilt milk
-  - crystal clear
-  - curiosity killed the cat
-  - cut and dried
-  - cut through the red tape
-  - cut to the chase
-  - cute as a bugs ear
-  - cute as a button
-  - cute as a puppy
-  - cuts to the quick
-  - dark before the dawn
-  - day in, day out
-  - dead as a doornail
-  - devil is in the details
-  - dime a dozen
-  - divide and conquer
-  - dog and pony show
-  - dog days
-  - dog eat dog
-  - dog tired
-  - don't burn your bridges
-  - don't count your chickens
-  - don't look a gift horse in the mouth
-  - don't rock the boat
-  - don't step on anyone's toes
-  - don't take any wooden nickels
-  - down and out
-  - down at the heels
-  - down in the dumps
-  - down the hatch
-  - down to earth
-  - draw the line
-  - dressed to kill
-  - dressed to the nines
-  - drives me up the wall
-  - dull as dishwater
-  - dyed in the wool
-  - eagle eye
-  - ear to the ground
-  - early bird catches the worm
-  - easier said than done
-  - easy as pie
-  - eat your heart out
-  - eat your words
-  - eleventh hour
-  - even the playing field
-  - every dog has its day
-  - every fiber of my being
-  - everything but the kitchen sink
-  - eye for an eye
-  - face the music
-  - facts of life
-  - fair weather friend
-  - fall by the wayside
-  - fan the flames
-  - feast or famine
-  - feather your nest
-  - feathered friends
-  - few and far between
-  - fifteen minutes of fame
-  - filthy vermin
-  - fine kettle of fish
-  - fish out of water
-  - fishing for a compliment
-  - fit as a fiddle
-  - fit the bill
-  - fit to be tied
-  - flash in the pan
-  - flat as a pancake
-  - flip your lid
-  - flog a dead horse
-  - fly by night
-  - fly the coop
-  - follow your heart
-  - for all intents and purposes
-  - for the birds
-  - for what it's worth
-  - force of nature
-  - force to be reckoned with
-  - forgive and forget
-  - fox in the henhouse
-  - free and easy
-  - free as a bird
-  - fresh as a daisy
-  - full steam ahead
-  - fun in the sun
-  - garbage in, garbage out
-  - gentle as a lamb
-  - get a kick out of
-  - get a leg up
-  - get down and dirty
-  - get the lead out
-  - get to the bottom of
-  - get your feet wet
-  - gets my goat
-  - gilding the lily
-  - give and take
-  - go against the grain
-  - go at it tooth and nail
-  - go for broke
-  - go him one better
-  - go the extra mile
-  - go with the flow
-  - goes without saying
-  - good as gold
-  - good deed for the day
-  - good things come to those who wait
-  - good time was had by all
-  - good times were had by all
-  - greased lightning
-  - greek to me
-  - green thumb
-  - green-eyed monster
-  - grist for the mill
-  - growing like a weed
-  - hair of the dog
-  - hand to mouth
-  - happy as a clam
-  - happy as a lark
-  - hasn't a clue
-  - have a nice day
-  - have high hopes
-  - have the last laugh
-  - haven't got a row to hoe
-  - head honcho
-  - head over heels
-  - hear a pin drop
-  - heard it through the grapevine
-  - heart's content
-  - heavy as lead
-  - hem and haw
-  - high and dry
-  - high and mighty
-  - high as a kite
-  - hit paydirt
-  - hold your head up high
-  - hold your horses
-  - hold your own
-  - hold your tongue
-  - honest as the day is long
-  - horns of a dilemma
-  - horse of a different color
-  - hot under the collar
-  - hour of need
-  - I beg to differ
-  - icing on the cake
-  - if the shoe fits
-  - if the shoe were on the other foot
-  - in a jam
-  - in a jiffy
-  - in a nutshell
-  - in a pig's eye
-  - in a pinch
-  - in a word
-  - in hot water
-  - in the gutter
-  - in the nick of time
-  - in the thick of it
-  - in your dreams
-  - it ain't over till the fat lady sings
-  - it goes without saying
-  - it takes all kinds
-  - it takes one to know one
-  - it's a small world
-  - it's only a matter of time
-  - ivory tower
-  - Jack of all trades
-  - jockey for position
-  - jog your memory
-  - joined at the hip
-  - judge a book by its cover
-  - jump down your throat
-  - jump in with both feet
-  - jump on the bandwagon
-  - jump the gun
-  - jump to conclusions
-  - just a hop, skip, and a jump
-  - just the ticket
-  - justice is blind
-  - keep a stiff upper lip
-  - keep an eye on
-  - keep it simple, stupid
-  - keep the home fires burning
-  - keep up with the Joneses
-  - keep your chin up
-  - keep your fingers crossed
-  - kick the bucket
-  - kick up your heels
-  - kick your feet up
-  - kid in a candy store
-  - kill two birds with one stone
-  - kiss of death
-  - knock it out of the park
-  - knock on wood
-  - knock your socks off
-  - know him from Adam
-  - know the ropes
-  - know the score
-  - knuckle down
-  - knuckle sandwich
-  - knuckle under
-  - labor of love
-  - ladder of success
-  - land on your feet
-  - lap of luxury
-  - last but not least
-  - last hurrah
-  - last-ditch effort
-  - law of the jungle
-  - law of the land
-  - lay down the law
-  - leaps and bounds
-  - let sleeping dogs lie
-  - let the cat out of the bag
-  - let the good times roll
-  - let your hair down
-  - let's talk turkey
-  - letter perfect
-  - lick your wounds
-  - lies like a rug
-  - life's a bitch
-  - life's a grind
-  - light at the end of the tunnel
-  - lighter than a feather
-  - lighter than air
-  - like clockwork
-  - like father like son
-  - like taking candy from a baby
-  - like there's no tomorrow
-  - lion's share
-  - live and learn
-  - live and let live
-  - long and short of it
-  - long lost love
-  - look before you leap
-  - look down your nose
-  - look what the cat dragged in
-  - looking a gift horse in the mouth
-  - looks like death warmed over
-  - loose cannon
-  - lose your head
-  - lose your temper
-  - loud as a horn
-  - lounge lizard
-  - loved and lost
-  - low man on the totem pole
-  - luck of the draw
-  - luck of the Irish
-  - make hay while the sun shines
-  - make money hand over fist
-  - make my day
-  - make the best of a bad situation
-  - make the best of it
-  - make your blood boil
-  - man of few words
-  - man's best friend
-  - mark my words
-  - meaningful dialogue
-  - missed the boat on that one
-  - moment in the sun
-  - moment of glory
-  - moment of truth
-  - money to burn
-  - more power to you
-  - more than one way to skin a cat
-  - movers and shakers
-  - moving experience
-  - naked as a jaybird
-  - naked truth
-  - neat as a pin
-  - needle in a haystack
-  - needless to say
-  - neither here nor there
-  - never look back
-  - never say never
-  - nip and tuck
-  - nip it in the bud
-  - no guts, no glory
-  - no love lost
-  - no pain, no gain
-  - no skin off my back
-  - no stone unturned
-  - no time like the present
-  - no use crying over spilled milk
-  - nose to the grindstone
-  - not a hope in hell
-  - not a minute's peace
-  - not in my backyard
-  - not playing with a full deck
-  - not the end of the world
-  - not written in stone
-  - nothing to sneeze at
-  - nothing ventured nothing gained
-  - now we're cooking
-  - off the top of my head
-  - off the wagon
-  - off the wall
-  - old hat
-  - older and wiser
-  - older than dirt
-  - older than Methuselah
-  - on a roll
-  - on cloud nine
-  - on pins and needles
-  - on the bandwagon
-  - on the money
-  - on the nose
-  - on the rocks
-  - on the spot
-  - on the tip of my tongue
-  - on the wagon
-  - on thin ice
-  - once bitten, twice shy
-  - one bad apple doesn't spoil the bushel
-  - one born every minute
-  - one brick short
-  - one foot in the grave
-  - one in a million
-  - one red cent
-  - only game in town
-  - open a can of worms
-  - open and shut case
-  - open the flood gates
-  - opportunity doesn't knock twice
-  - out of pocket
-  - out of sight, out of mind
-  - out of the frying pan into the fire
-  - out of the woods
-  - out on a limb
-  - over a barrel
-  - over the hump
-  - pain and suffering
-  - pain in the
-  - panic button
-  - par for the course
-  - part and parcel
-  - party pooper
-  - pass the buck
-  - patience is a virtue
-  - pay through the nose
-  - penny pincher
-  - perfect storm
-  - pig in a poke
-  - pile it on
-  - pillar of the community
-  - pin your hopes on
-  - pitter patter of little feet
-  - plain as day
-  - plain as the nose on your face
-  - play by the rules
-  - play your cards right
-  - playing the field
-  - playing with fire
-  - pleased as punch
-  - plenty of fish in the sea
-  - point with pride
-  - poor as a church mouse
-  - pot calling the kettle black
-  - pretty as a picture
-  - pull a fast one
-  - pull your punches
-  - pulling your leg
-  - pure as the driven snow
-  - put it in a nutshell
-  - put one over on you
-  - put the cart before the horse
-  - put the pedal to the metal
-  - put your best foot forward
-  - put your foot down
-  - quick as a bunny
-  - quick as a lick
-  - quick as a wink
-  - quick as lightning
-  - quiet as a dormouse
-  - rags to riches
-  - raining buckets
-  - raining cats and dogs
-  - rank and file
-  - rat race
-  - reap what you sow
-  - red as a beet
-  - red herring
-  - reinvent the wheel
-  - rich and famous
-  - rings a bell
-  - ripe old age
-  - ripped me off
-  - rise and shine
-  - road to hell is paved with good intentions
-  - rob Peter to pay Paul
-  - roll over in the grave
-  - rub the wrong way
-  - ruled the roost
-  - running in circles
-  - sad but true
-  - sadder but wiser
-  - salt of the earth
-  - scared stiff
-  - scared to death
-  - sealed with a kiss
-  - second to none
-  - see eye to eye
-  - seen the light
-  - seize the day
-  - set the record straight
-  - set the world on fire
-  - set your teeth on edge
-  - sharp as a tack
-  - shoot for the moon
-  - shoot the breeze
-  - shot in the dark
-  - shoulder to the wheel
-  - sick as a dog
-  - sigh of relief
-  - signed, sealed, and delivered
-  - sink or swim
-  - six of one, half a dozen of another
-  - skating on thin ice
-  - slept like a log
-  - slinging mud
-  - slippery as an eel
-  - slow as molasses
-  - smart as a whip
-  - smooth as a baby's bottom
-  - sneaking suspicion
-  - snug as a bug in a rug
-  - sow wild oats
-  - spare the rod, spoil the child
-  - speak of the devil
-  - spilled the beans
-  - spinning your wheels
-  - spitting image of
-  - spoke with relish
-  - spread like wildfire
-  - spring to life
-  - squeaky wheel gets the grease
-  - stands out like a sore thumb
-  - start from scratch
-  - stick in the mud
-  - still waters run deep
-  - stitch in time
-  - stop and smell the roses
-  - straight as an arrow
-  - straw that broke the camel's back
-  - strong as an ox
-  - stubborn as a mule
-  - stuff that dreams are made of
-  - stuffed shirt
-  - sweating blood
-  - sweating bullets
-  - take a load off
-  - take one for the team
-  - take the bait
-  - take the bull by the horns
-  - take the plunge
-  - takes one to know one
-  - takes two to tango
-  - the more the merrier
-  - the real deal
-  - the real McCoy
-  - the red carpet treatment
-  - the same old story
-  - there is no accounting for taste
-  - thick as a brick
-  - thick as thieves
-  - thin as a rail
-  - think outside of the box
-  - third time's the charm
-  - this day and age
-  - this hurts me worse than it hurts you
-  - this point in time
-  - three sheets to the wind
-  - through thick and thin
-  - throw in the towel
-  - tie one on
-  - tighter than a drum
-  - time and time again
-  - time is of the essence
-  - tip of the iceberg
-  - tired but happy
-  - to coin a phrase
-  - to each his own
-  - to make a long story short
-  - to the best of my knowledge
-  - toe the line
-  - tongue in cheek
-  - too good to be true
-  - too hot to handle
-  - too numerous to mention
-  - touch with a ten foot pole
-  - tough as nails
-  - trial and error
-  - trials and tribulations
-  - tried and true
-  - trip down memory lane
-  - twist of fate
-  - two cents worth
-  - two peas in a pod
-  - ugly as sin
-  - under the counter
-  - under the gun
-  - under the same roof
-  - under the weather
-  - until the cows come home
-  - unvarnished truth
-  - up the creek
-  - uphill battle
-  - upper crust
-  - upset the applecart
-  - vain attempt
-  - vain effort
-  - vanquish the enemy
-  - vested interest
-  - waiting for the other shoe to drop
-  - wakeup call
-  - warm welcome
-  - watch your p's and q's
-  - watch your tongue
-  - watching the clock
-  - water under the bridge
-  - weather the storm
-  - weed them out
-  - week of Sundays
-  - went belly up
-  - wet behind the ears
-  - what goes around comes around
-  - what you see is what you get
-  - when it rains, it pours
-  - when push comes to shove
-  - when the cat's away
-  - when the going gets tough, the tough get going
-  - white as a sheet
-  - whole ball of wax
-  - whole hog
-  - whole nine yards
-  - wild goose chase
-  - will wonders never cease?
-  - wisdom of the ages
-  - wise as an owl
-  - wolf at the door
-  - words fail me
-  - work like a dog
-  - world weary
-  - worst nightmare
-  - worth its weight in gold
-  - wrong side of the bed
-  - yanking your chain
-  - yappy as a dog
-  - years young
-  - you are what you eat
-  - you can run but you can't hide
-  - you only live once
-  - you're the boss
-  - young and foolish
-  - young and vibrant
@@ -1,32 +0,0 @@
-extends: existence
-message: "Try to avoid using '%s'."
-ignorecase: true
-level: suggestion
-tokens:
-  - am
-  - are
-  - aren't
-  - be
-  - been
-  - being
-  - he's
-  - here's
-  - here's
-  - how's
-  - i'm
-  - is
-  - isn't
-  - it's
-  - she's
-  - that's
-  - there's
-  - they're
-  - was
-  - wasn't
-  - we're
-  - were
-  - weren't
-  - what's
-  - where's
-  - who's
-  - you're
@@ -1,11 +0,0 @@
-extends: repetition
-message: "'%s' is repeated!"
-level: warning
-alpha: true
-action:
-  name: edit
-  params:
-    - truncate
-    - " "
-tokens:
-  - '[^\s]+'
@@ -1,183 +0,0 @@
-extends: existence
-message: "'%s' may be passive voice. Use active voice if you can."
-ignorecase: true
-level: warning
-raw:
-  - \b(am|are|were|being|is|been|was|be)\b\s*
-tokens:
-  - '[\w]+ed'
-  - awoken
-  - beat
-  - become
-  - been
-  - begun
-  - bent
-  - beset
-  - bet
-  - bid
-  - bidden
-  - bitten
-  - bled
-  - blown
-  - born
-  - bought
-  - bound
-  - bred
-  - broadcast
-  - broken
-  - brought
-  - built
-  - burnt
-  - burst
-  - cast
-  - caught
-  - chosen
-  - clung
-  - come
-  - cost
-  - crept
-  - cut
-  - dealt
-  - dived
-  - done
-  - drawn
-  - dreamt
-  - driven
-  - drunk
-  - dug
-  - eaten
-  - fallen
-  - fed
-  - felt
-  - fit
-  - fled
-  - flown
-  - flung
-  - forbidden
-  - foregone
-  - forgiven
-  - forgotten
-  - forsaken
-  - fought
-  - found
-  - frozen
-  - given
-  - gone
-  - gotten
-  - ground
-  - grown
-  - heard
-  - held
-  - hidden
-  - hit
-  - hung
-  - hurt
-  - kept
-  - knelt
-  - knit
-  - known
-  - laid
-  - lain
-  - leapt
-  - learnt
-  - led
-  - left
-  - lent
-  - let
-  - lighted
-  - lost
-  - made
-  - meant
-  - met
-  - misspelt
-  - mistaken
-  - mown
-  - overcome
-  - overdone
-  - overtaken
-  - overthrown
-  - paid
-  - pled
-  - proven
-  - put
-  - quit
-  - read
-  - rid
-  - ridden
-  - risen
-  - run
-  - rung
-  - said
-  - sat
-  - sawn
-  - seen
-  - sent
-  - set
-  - sewn
-  - shaken
-  - shaven
-  - shed
-  - shod
-  - shone
-  - shorn
-  - shot
-  - shown
-  - shrunk
-  - shut
-  - slain
-  - slept
-  - slid
-  - slit
-  - slung
-  - smitten
-  - sold
-  - sought
-  - sown
-  - sped
-  - spent
-  - spilt
-  - spit
-  - split
-  - spoken
-  - spread
-  - sprung
-  - spun
-  - stolen
-  - stood
-  - stridden
-  - striven
-  - struck
-  - strung
-  - stuck
-  - stung
-  - stunk
-  - sung
-  - sunk
-  - swept
-  - swollen
-  - sworn
-  - swum
-  - swung
-  - taken
-  - taught
-  - thought
-  - thrived
-  - thrown
-  - thrust
-  - told
-  - torn
-  - trodden
-  - understood
-  - upheld
-  - upset
-  - wed
-  - wept
-  - withheld
-  - withstood
-  - woken
-  - won
-  - worn
-  - wound
-  - woven
-  - written
-  - wrung
@@ -1,27 +0,0 @@
-Based on [write-good](https://github.com/btford/write-good).
-
-> Naive linter for English prose for developers who can't write good and wanna learn to do other stuff good too.
-
-```
-The MIT License (MIT)
-
-Copyright (c) 2014 Brian Ford
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
@@ -1,5 +0,0 @@
-extends: existence
-message: "Don't start a sentence with '%s'."
-level: error
-raw:
-  - '(?:[;-]\s)so[\s,]|\bSo[\s,]'
@@ -1,6 +0,0 @@
-extends: existence
-message: "Don't start a sentence with '%s'."
-ignorecase: false
-level: error
-raw:
-  - '(?:[;-]\s)There\s(is|are)|\bThere\s(is|are)\b'
@@ -1,221 +0,0 @@
-extends: existence
-message: "'%s' is too wordy."
-ignorecase: true
-level: warning
-tokens:
-  - a number of
-  - abundance
-  - accede to
-  - accelerate
-  - accentuate
-  - accompany
-  - accomplish
-  - accorded
-  - accrue
-  - acquiesce
-  - acquire
-  - additional
-  - adjacent to
-  - adjustment
-  - admissible
-  - advantageous
-  - adversely impact
-  - advise
-  - aforementioned
-  - aggregate
-  - aircraft
-  - all of
-  - all things considered
-  - alleviate
-  - allocate
-  - along the lines of
-  - already existing
-  - alternatively
-  - amazing
-  - ameliorate
-  - anticipate
-  - apparent
-  - appreciable
-  - as a matter of fact
-  - as a means of
-  - as far as I'm concerned
-  - as of yet
-  - as to
-  - as yet
-  - ascertain
-  - assistance
-  - at the present time
-  - at this time
-  - attain
-  - attributable to
-  - authorize
-  - because of the fact that
-  - belated
-  - benefit from
-  - bestow
-  - by means of
-  - by virtue of
-  - by virtue of the fact that
-  - cease
-  - close proximity
-  - commence
-  - comply with
-  - concerning
-  - consequently
-  - consolidate
-  - constitutes
-  - demonstrate
-  - depart
-  - designate
-  - discontinue
-  - due to the fact that
-  - each and every
-  - economical
-  - eliminate
-  - elucidate
-  - employ
-  - endeavor
-  - enumerate
-  - equitable
-  - equivalent
-  - evaluate
-  - evidenced
-  - exclusively
-  - expedite
-  - expend
-  - expiration
-  - facilitate
-  - factual evidence
-  - feasible
-  - finalize
-  - first and foremost
-  - for all intents and purposes
-  - for the most part
-  - for the purpose of
-  - forfeit
-  - formulate
-  - have a tendency to
-  - honest truth
-  - however
-  - if and when
-  - impacted
-  - implement
-  - in a manner of speaking
-  - in a timely manner
-  - in a very real sense
-  - in accordance with
-  - in addition
-  - in all likelihood
-  - in an effort to
-  - in between
-  - in excess of
-  - in lieu of
-  - in light of the fact that
-  - in many cases
-  - in my opinion
-  - in order to
-  - in regard to
-  - in some instances
-  - in terms of
-  - in the case of
-  - in the event that
-  - in the final analysis
-  - in the nature of
-  - in the near future
-  - in the process of
-  - inception
-  - incumbent upon
-  - indicate
-  - indication
-  - initiate
-  - irregardless
-  - is applicable to
-  - is authorized to
-  - is responsible for
-  - it is
-  - it is essential
-  - it seems that
-  - it was
-  - magnitude
-  - maximum
-  - methodology
-  - minimize
-  - minimum
-  - modify
-  - monitor
-  - multiple
-  - necessitate
-  - nevertheless
-  - not certain
-  - not many
-  - not often
-  - not unless
-  - not unlike
-  - notwithstanding
-  - null and void
-  - numerous
-  - objective
-  - obligate
-  - obtain
-  - on the contrary
-  - on the other hand
-  - one particular
-  - optimum
-  - overall
-  - owing to the fact that
-  - participate
-  - particulars
-  - pass away
-  - pertaining to
-  - point in time
-  - portion
-  - possess
-  - preclude
-  - previously
-  - prior to
-  - prioritize
-  - procure
-  - proficiency
-  - provided that
-  - purchase
-  - put simply
-  - readily apparent
-  - refer back
-  - regarding
-  - relocate
-  - remainder
-  - remuneration
-  - requirement
-  - reside
-  - residence
-  - retain
-  - satisfy
-  - shall
-  - should you wish
-  - similar to
-  - solicit
-  - span across
-  - strategize
-  - subsequent
-  - substantial
-  - successfully complete
-  - sufficient
-  - terminate
-  - the month of
-  - the point I am trying to make
-  - therefore
-  - time period
-  - took advantage of
-  - transmit
-  - transpire
-  - type of
-  - until such time as
-  - utilization
-  - utilize
-  - validate
-  - various different
-  - what I mean to say is
-  - whether or not
-  - with respect to
-  - with the exception of
-  - witnessed
@@ -1,29 +0,0 @@
-extends: existence
-message: "'%s' is a weasel word!"
-ignorecase: true
-level: warning
-tokens:
-  - clearly
-  - completely
-  - exceedingly
-  - excellent
-  - extremely
-  - fairly
-  - huge
-  - interestingly
-  - is a number
-  - largely
-  - mostly
-  - obviously
-  - quite
-  - relatively
-  - remarkably
-  - several
-  - significantly
-  - substantially
-  - surprisingly
-  - tiny
-  - usually
-  - various
-  - vast
-  - very
@@ -1,4 +0,0 @@
-{
-  "feed": "https://github.com/errata-ai/write-good/releases.atom",
-  "vale_version": ">=1.0.0"
-}
@@ -1,673 +0,0 @@
-# AGENTS.md — Project Conventions for devx
-
-## Virtual Environment
-
-All Python tools, tests, and scripts run inside a standard `.venv` directory.
-Activate it before running any non-`make` command:
-
-```bash
-source activate.sh       # bash/zsh
-source activate.fish     # fish
-source activate.zsh      # zsh
-```
-
-If `.venv` doesn't exist, run `make setup` first. The `make` targets handle
-venv activation automatically — always prefer `make <target>` over raw commands.
-
-## Build & Test Commands
-
-```bash
-make setup           # Create venv, install deps, set up hooks, install CI tools
-make install-tools   # Install actionlint, git-cliff, act_runner, tea, hadolint, vale to ~/.local/bin
-make lint-all        # ruff + pyright + bandit + actionlint + lint-dockerfiles
-make pytest-cov      # Unit tests with 100% coverage enforcement
-make test-unit       # Unit tests without coverage
-make workflow-lint   # Static lint of .gitea/workflows/*.yml (actionlint)
-make workflow-dryrun # Dry-run all workflows in Docker (act_runner exec --dryrun)
-make workflow-check  # workflow-lint + workflow-dryrun
-make devx-check-doc-versions  # Verify docs version refs match __version__
-make devx-vale       # Run Vale prose linter on docs and README
-make clean           # Remove caches, build artifacts, coverage data
-```
-
-`make setup` automatically installs all development tools:
- **Python deps** via `python -m devx.tools.setup` (pip install -e .[dev], pre-commit hooks)
- **actionlint, git-cliff, act_runner, tea, hadolint, vale** via `python -m devx.tools.install_tools` (CI/CD tools to ~/.local/bin)
- **tea CLI login** via `python -m devx.tools.setup` (configures `tea login` from `.env` `CI_GITEA_TOKEN`)
-
-## Workflow Verification (Before Push)
-
-Workflow YAML files (`.gitea/workflows/*.yml`) are verified with two tools:
-
-1. **actionlint** — Static linter that catches syntax errors, invalid
-   expressions, unknown keys, type mismatches, and shellcheck issues.
-   Config: `.gitea/actionlint.yaml` (registers custom `docker` runner label).
-   Installed automatically by `make setup` via `python -m devx.tools.install_tools`.
-
-2. **act_runner exec --dryrun** — Gitea's own runner in dry-run mode.
-   Validates job dependencies, step ordering, and Docker image selection
-   without starting containers. Installed automatically by `make setup`.
-
-Both run via `make workflow-check` and are part of `make lint-all`.
-The pre-commit hook runs actionlint automatically when workflow files change.
-The CI `validate` job runs `make setup-image` then `make lint-all`.
-CI also runs a best-effort `make workflow-dryrun` step (skipped if act_runner is not installed in the CI Docker image).
-
-## Architecture
-
-devx is a reusable Python package providing development and CI/CD tools for oblachno-oss projects.
-
-### Package Structure
-
-```text
-src/devx/
-├── __init__.py          # Version (single source of truth, read by setuptools)
-├── cli.py               # Click-based CLI entry point (devx command)
-├── config.py            # Configuration system (DEVX_ env vars, .env loading)
-├── api_clients.py       # GiteaClient, VikunjaClient — HTTP API wrappers
-├── gitea_cli.py         # TeaCLI — wrapper around tea CLI with JSON parsing
-├── i18n.py              # Translation system (gettext-based, translations.json)
-├── exceptions.py        # Custom exception types
-├── translations.json    # Translation strings (en, bg, de, pl, ru, zh)
-├── ci/                  # CI/CD automation modules (run by workflows)
-│   ├── release.py       # Automated versioning, tagging, changelog
-│   ├── publish.py       # Build, publish to Gitea PyPI registry, create Gitea release (with retry)
-│   ├── auto_merge.py    # Squash-merge PRs with task ID validation
-│   ├── check_auto_merge_ready.py  # Pre-merge validation gate (branch, PR title, Vikunja, behind-master)
-│   ├── _shared.py      # Shared utilities (get_latest_tag)
-│   ├── classify_changes.py  # User-facing vs infrastructure change detection
-│   ├── detect_release_commit.py  # Detect release commits on master
-│   ├── validate_commit_msg.py    # Conventional commit validation
-│   ├── pr_review.py     # Automated PR review + manual reviews (--event, --body, --checklist-confirmed)
-│   ├── post_merge.py    # Vikunja task updates after merge
-│   ├── sync_wiki.py     # Sync documentation to Gitea wiki
-│   ├── push_badges.py   # Generate and push quality badges (--retries for retry on git push failures)
-│   ├── notify_failure.py    # Create Gitea issues on CI failures (--auto-login)
-│   ├── distribute_files.py  # Distribute files across parallel runners (LPT scheduling)
-│   ├── distribute_items.py  # Distribute generic items (VMs, hosts) across parallel runners (LPT)
-│   ├── integration_guard.py # Run pytest with cross-runner fail-fast
-│   ├── check_translations.py  # Translation completeness check
-│   ├── doc_coverage.py  # Documentation coverage check
-│   ├── lint_docs.py  # Documentation linter (structure, links, headings, code blocks, orphans)
-│   ├── validate_deploy_ref.py  # Validate git tag for deployments (--github-output)
-│   └── record_deployed_tag.py  # Record deployed tag to Gitea repo variable
-├── tools/               # Developer tooling modules (run locally or by CI)
-│   ├── setup.py         # Environment setup (venv, deps, hooks)
-│   ├── install_tools.py # Install actionlint, git-cliff, act_runner, tea, hadolint, vale
-│   ├── install_checkmake.py  # Install checkmake (Makefile linter)
-│   ├── check_doc_versions.py  # Verify docs version refs match __version__
-│   ├── build_image.py   # Build and push Docker images to Gitea registry
-│   ├── clean_images.py  # Clean up old Docker image versions from Gitea registry
-│   ├── check_test_speed.py  # Measure unit test execution time
-│   ├── check_mutable_globals.py  # Detect module-level mutable globals (test isolation bugs)
-│   ├── check_pyproject_deps.py   # Validate pyproject.toml deps have documentation comments
-│   ├── check_test_coverage.py    # Ensure changed files have corresponding tests (configurable rules)
-│   ├── check_agent_docs.py       # Validate docs for stale file references (configurable patterns)
-│   ├── check_config.py       # Validate pyproject.toml [tool.devx] config
-│   ├── configure_repo.py    # Branch protection and label setup
-│   ├── generate_badges.py   # Badge SVG generation
-│   ├── generate_cliff_config.py  # Generate git-cliff config (cliff.toml)
-│   ├── create_task.py       # Create Vikunja tasks
-│   ├── create_pr.py         # Create PRs with auto-derived title from Vikunja
-│   ├── pr_status.py         # Check CI status for a PR/commit (--wait polls)
-│   ├── pr_logs.py           # Fetch logs for failed CI jobs
-│   ├── pr_label.py          # Add labels to PRs (idempotent)
-│   ├── pre_push_check.py    # Validate Vikunja task existence before push
-│   └── _shared.py           # Shared tool utilities
-├── opentofu.py          # OpenTofu output helpers (get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field)
-├── utils/               # Shared utilities (reusable across projects)
-│   ├── api.py            # API response helpers (is_truthy, is_falsy)
-│   ├── ssh.py            # SSH exec + wait_for_ssh (pure-Python socket check)
-│   ├── crypto.py         # Secret generation (shell-safe passwords)
-│   ├── vault.py          # Ansible vault encrypt/decrypt helpers
-│   ├── network.py        # HTTP connectivity check + wait_for_ssh
-│   ├── confirm.py        # Typed confirmation validation for destructive ops
-│   ├── json_registry.py  # File-locked JSON registry for local state
-│   ├── step_tracker.py   # Multi-step operation tracking with reports
-│   └── logging.py        # XDG-compliant logging configuration
-└── molecule/            # Optional molecule testing helpers (for Ansible projects)
-    ├── discover_runners.py    # Dynamic Gitea runner discovery
-    ├── distribute_molecule.py # Distribute molecule scenarios across runners (LPT scheduling, --roles-root for multi-role)
-    ├── molecule_ci_guard.py   # Run molecule with cross-runner fail-fast (--roles-root)
-    ├── molecule_all.py        # Run all molecule scenarios locally
-    ├── start_docker.py        # Ensure Docker daemon is running for molecule tests
-    └── platforms.py           # Supported molecule platforms
-```
-
-### Key Design Principles
-
- **Self-contained package** — `src/devx/` never imports from scripts outside the package
- **Module-based invocation** — All tools invoked via `python -m devx.ci.*` or `python -m devx.tools.*`
- **PYTHONPATH: src** — Workflows set `PYTHONPATH: src` (NOT `.:src` since there are no scripts at repo root)
- **Config via env vars** — `DEVX_*` environment variables with `.env` file fallback
-
-## PR Workflow (Mandatory)
-
-Every change to master goes through this workflow. No exceptions.
-
-### Branch Protection (Required Gitea Settings)
-
-Branch protection and labels are automatically configured by
-`python -m devx.tools.configure_repo`, which runs as a step in the
-`detect-and-configure` job in the post-merge workflow on every push to master.
-
-The following rules are enforced for `master`:
- **Require pull request**: No direct pushes to master
- **Require approval review**: At least 1 `APPROVE` review before merge
- **Require status checks**: CI validate must pass
- **Block force pushes**: No history rewriting on master
-
-### 1. Create Vikunja Task
-Create a task in Vikunja to get a `DEVX-N` identifier.
-
-**IMPORTANT:** The task title must NOT include the `DEVX-N:` prefix.
-The `make create-pr` and `check_auto_merge_ready` commands automatically
-prepend `DEVX-N: ` to the Vikunja task title when forming the PR title.
-If the Vikunja task title already includes the prefix, the PR title will
-have a double prefix and auto-merge validation will fail.
-
-### 2. Create Branch
-```bash
-git checkout master && git pull
-git checkout -b DEVX-N-short-description
-```
-
-### 3. Implement Changes
- Write code following conventions below
- Write/update tests (100% coverage required)
- Update documentation (CHANGELOG, README, AGENTS.md as needed)
-
-### 4. Commit (Conventional Commits)
-Branch commits use conventional commit format (no `DEVX-N:` prefix):
-```text
-feat: add new feature
-fix: resolve bug
-docs: update README
-```
-
-### 5. Push and Create PR
- **PR title format**: `DEVX-N: <vikunja task title>` (must match the Vikunja task title exactly)
- PR body: summary of changes, `Closes DEVX-N`
- Add `ready-to-merge` label **only after review is complete**
-
-### 6. Review the PR
-
-**Automated review (CI `validate` job):** Every PR triggers an automated
-review via `python -m devx.ci.pr_review` as a step in the `validate` job.
-This posts a review with
-`COMMENT` (no issues) or `REQUEST_CHANGES` (issues found):
-
- Architecture compliance (no subprocess in CLI, no hardcoded URLs)
- Best practices (no `print()`, no bare `except`, no `TODO`/`FIXME`,
-  no functions > 50 lines)
- Security (no hardcoded secrets, no `shell=True`, no `eval`/`exec`)
- i18n (no raw strings in `click.echo()` without `_()` wrapper)
- Resource management (no `open()` without `with`, no `Popen()` without cleanup)
- Documentation (source changes must include doc updates)
- Test coverage (source changes must include test updates)
- Commit conventions (conventional commit format on PR commits)
-
-The agent **must** address all `REQUEST_CHANGES` issues before proceeding.
-
-### 7. Address Review Comments
-Fix each comment one by one, commit, and push. Re-review until satisfied.
-
-### 8. Approve and Merge
-Once all checklist items are verified and comments are addressed, approve
-the PR. Then add the `ready-to-merge` label. The auto-merge workflow will:
-1. **Validate** PR title format (`DEVX-N: <vikunja task title>`) and match against Vikunja task title
-2. **Check** that at least one substantive APPROVE review exists
-3. Wait for all CI checks to pass (including the `validate` job)
-4. Squash-merge with title: `DEVX-N: <conventional commit message>`
-5. The post-merge workflow marks the Vikunja task as done
-6. The release workflow automatically versions, tags, and publishes
-
-> **IMPORTANT**: Never manually merge PRs via the API. Always use the auto-merge
-> workflow by adding the `ready-to-merge` label.
-
-### Automated Release Pipeline
-
-After a PR is merged to master, the **post-merge workflow**
-(`.gitea/workflows/post-merge.yml`) runs automatically. Consolidated
-into 2 jobs (from 7) to reduce runner overhead:
-
-1. **detect-and-configure** — Configures repo (branch protection, labels),
-   detects release commit, validates commit message. Outputs `is-release`
-   and `is-automated` for the next job.
-
-2. **release-and-maintain** — Runs all post-merge maintenance as
-   conditional steps:
-   - **release** (if not a release commit) — Runs `python -m devx.ci.release`
-     which checks for user-facing changes via `classify_changes`, uses
-     git-cliff for semver, updates `__version__`, updates `CHANGELOG.md`,
-     runs lint+tests, commits with `release: vX.Y.Z [skip ci]`, creates
-     annotated tag, pushes to master.
-   - **publish** (if release created a tag) — Builds and publishes the
-     package to the Gitea PyPI registry. Checks out the release tag
-     within the same job.
-   - **sync-wiki** (if not automated) — Syncs documentation to the Gitea wiki.
-   - **vikunja** (if not automated) — Marks the corresponding Vikunja task as done.
-   - **badges** (always) — Generates and pushes quality badge SVGs to the
-     `badges` branch. Fetches latest master first to pick up release commits.
-
-### Smart CI: User-Facing vs Workflow-Only Changes
-
-Not all changes require a new release. The project classifies changes
-using `python -m devx.ci.classify_changes`:
-
-**Workflow-only paths** (infrastructure → no release needed):
- `.gitea/**` — Gitea Actions workflows
- `tests/**` — Test files
- `AGENTS.md`, `README.md`, `CHANGELOG.md` — Project docs
- `Makefile`, `cliff.toml`, `.pre-commit-config.yaml` — Config
- `.env.example`, `.gitignore` — Config
- `hooks/**` — Git hooks
-
-**User-facing paths** (tool changes → release needed) — everything else:
- `src/devx/**` — Python package source (except `__init__.py`)
- `pyproject.toml` — Package metadata
- Any new file type not in the allowlist
-
-## Script Separation and Import Rules
-
-### Directory Layout
-
-| Directory | Purpose | Release impact |
-|-----------|---------|----------------|
-| `src/devx/` | User-facing devx package | Changes trigger release |
-| `src/devx/ci/` | CI/CD automation (run by workflows) | Part of package |
-| `src/devx/tools/` | Developer tooling (run locally or by CI) | Part of package |
-| `tests/` | Test files | Workflow-only (no release) |
-
-### Import Rules
-
-1. **`src/devx/` is self-contained** — the package never imports from outside `src/`
-2. **CI modules** (`devx.ci.*`) may import from `devx.api_clients`, `devx.config`, `devx.gitea_cli`, `devx.i18n`
-3. **Tool modules** (`devx.tools.*`) may import from `devx.api_clients`, `devx.config`, `devx.gitea_cli`
-4. **Cross-module imports** within `devx.ci.*` or `devx.tools.*` are allowed but must be documented
-
-### PYTHONPATH Configuration
-
-All workflows use `PYTHONPATH: src` — devx has no scripts at the repo root,
-so `.:src` is not needed. The `src` directory is the sole import root.
-
-```yaml
- name: Run script
-  env:
-    PYTHONPATH: src
-  run: python -m devx.ci.example
-```
-
-### tea CLI Integration
-
-The `tea` Gitea CLI tool is used for Gitea API interactions. It is installed
-by `python -m devx.tools.install_tools` and configured by
-`python -m devx.tools.setup` (login profile from `.env` `CI_GITEA_TOKEN`).
-
-**`devx.gitea_cli.TeaCLI`** — Python wrapper around `tea` CLI with JSON output parsing:
- `create_issue()` — Create issues with labels
- `list_labels()` / `create_label()` / `add_label()` — Label management
- `create_pr()` / `merge_pr()` / `review_pr()` — Pull request operations
- `create_release()` / `list_releases()` — Release management
-
-**`devx.gitea_cli.configure_tea_login()`** — Configures tea login in
-containerized CI environments where `make setup` was not called. Used by
-`publish.py` (`--auto-login`) and `notify_failure.py` (`--auto-login`).
-Raises `TeaCLIError` if login configuration fails — this prevents cryptic
-"no available login" errors from subsequent tea commands.
-
-**Error handling**: `TeaCLI._run()` includes both stdout and stderr in
-`TeaCLIError` messages, because `tea` writes some errors (for example,
-"no available login") to stdout, not stderr.
-
-**Release creation retry**: `publish.py` retries Gitea release creation
-up to 3 times with exponential backoff (2s, 4s) on transient failures.
-"Already exists" errors are treated as success (idempotent).
-
-### git-cliff Commit Preprocessing
-
-Merge commits on master have the format `DEVX-N: <conventional commit>`. The
-`cliff.toml` includes a `commit_preprocessors` entry that strips the `DEVX-N `
-prefix before parsing. This ensures all merged work appears in the changelog.
-
-### Version Bumping Rules (git-cliff)
-
-| Commit type | Version bump |
-|-------------|-------------|
-| `feat:` | minor (0.X.0) |
-| `fix:` | patch (0.0.X) |
-| `feat!:` or `BREAKING CHANGE` | minor (pre-1.0) |
-| `chore:`, `ci:`, `docs:` | no bump (excluded by cliff.toml) |
-
-The version source is `__version__` in `src/devx/__init__.py`, read by
-setuptools via `dynamic = ["version"]` in `pyproject.toml`.
-
-### Title Format Summary
-
-| What | Format | Example |
-|------|--------|---------|
-| Branch name | `DEVX-N-short-description` | `DEVX-12-add-release-script` |
-| Branch commits | `<conventional commit>` | `feat: add release script` |
-| PR title | `DEVX-N: <vikunja task title>` | `DEVX-12: Add release automation` |
-| Merge commit | `DEVX-N: <conventional commit>` | `DEVX-12: feat: add release script` |
-
-### Task ID Resolution
-
-`auto_merge` resolves the task ID solely from the branch name (for example
-`DEVX-12-fix-foo` → `DEVX-12`). Branch names must include the task ID
-prefix — there is no `.taskid` file fallback. If a stale `.taskid` file
-exists in the repo, a deprecation warning is printed advising its removal.
-
-### Workflow `auto-merge` Job and `always()`
-
-When `auto-merge` depends on a job that can be skipped (for example
-`molecule-tests`), the `if:` condition MUST include `always() &&`
-at the start. Without it, Gitea Actions skips `auto-merge` when any
-dependency is skipped, even if the condition explicitly allows
-`result == 'skipped'`.
-
-```yaml
-auto-merge:
-  needs: [validate, molecule-tests]
-  if: >-
-    always() &&
-    github.event_name == 'pull_request' &&
-    needs.validate.result == 'success' &&
-    (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
-```
-
-### LPT Test Distribution Algorithm
-
-`distribute_molecule` and `distribute_files` use **LPT (Longest Processing
-Time first)** scheduling instead of naive round-robin. This produces a more
-balanced distribution when test items have varying costs:
-
-1. **Weight estimation**: Each item is assigned a weight:
-   - Molecule scenarios: heuristic by name (`nextcloud`=10, `gitea`=8,
-     `binary`=2, default=3). See `_SCENARIO_WEIGHTS` in
-     `distribute_molecule.py`.
-   - Integration test files: weight by file size in bytes (as a proxy
-     for test runtime).
-2. **LPT assignment**: Items are sorted by weight (descending), then
-   each is assigned to the runner with the least total weight.
-
-This ensures heavy scenarios (for example `nextcloud`) are spread across
-different runners rather than clustered on one, reducing the
-longest-runner time from ~16 min to ~11 min with 6 runners.
-
-## Config System
-
-devx uses environment variables with `.env` file fallback for configuration.
-
-### DEVX_ Environment Variables
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `DEVX_GITEA_API_URL` | `https://git.oblachno.oblachno.fyi/api/v1` | Gitea API base URL |
-| `DEVX_VIKUNJA_API_URL` | `https://work.oblachno.oblachno.fyi/api/v1` | Vikunja API base URL |
-| `DEVX_REPO_OWNER` | **(none — must be set)** | Repository owner for API calls |
-| `DEVX_REPO_NAME` | **(none — must be set)** | Repository name (or `owner/repo`) |
-| `DEVX_TASK_PREFIX` | `DEVX` | Task ID prefix (GRM, OBL-INFRA, etc.) |
-| `DEVX_VIKUNJA_PROJECT_ID` | `6` | Vikunja project ID |
-| `DEVX_LANG` | `en` | Language for i18n (en, bg, de, pl, ru, zh) |
-| `CI_GITEA_TOKEN` | (from .env) | Gitea API token |
-| `VIKUNJA_TOKEN` | (from .env) | Vikunja API token |
-
-### Per-Project Overrides
-
-Projects using devx can override the default API URLs and language by setting
-`DEVX_*` environment variables or entries in their `.env` file. The config
-system loads `.env` automatically via `python-dotenv`.
-
-### pyproject.toml [tool.devx] Configuration
-
-In addition to `DEVX_` env vars, many devx tools read configuration from
-the `[tool.devx]` section in `pyproject.toml`. This allows per-project
-customization without environment variables.
-
-**Base config** (`[tool.devx]`):
- `task_prefix` — Task ID prefix (for example `"DEVX"`, `"GRM"`, `"OBL-INFRA"`)
- `vikunja_project_id` — Vikunja project ID
- `repo_owner` / `repo_name` — Gitea repository coordinates
- `gitea_api_url` / `vikunja_api_url` — API endpoints
-
-**Tool-specific config**:
- `[tool.devx.check_mutable_globals]` — `scan_dirs`, `skip_dirs`, `known_safe`
- `[tool.devx.check_test_coverage]` — `rules` (source_pattern → test_paths mapping), `skip_patterns`
- `[tool.devx.check_agent_docs]` — `scan_dirs`, `deleted_files`, `deprecated_patterns`, `legitimate_indicators`
-
-## devx.mak — Shared Makefile Fragment
-
-`devx.mak` provides common Makefile targets that projects can include
-via `-include $(DEVX_MAK)`. This eliminates Makefile duplication across
-projects.
-
-**Available targets** (all prefixed with `devx-`):
-
-| Target | Purpose |
-|--------|---------|
-| `devx-create-task` | Create a Vikunja task |
-| `devx-create-pr` | Create a PR with auto-derived title |
-| `devx-push` | Push current branch to origin |
-| `devx-push-with-pr` | Push and create PR in one step |
-| `devx-pr-status` | Check CI status for a PR (`PR=`, `WAIT=`, `TIMEOUT=`) |
-| `devx-pr-logs` | Fetch logs for failed CI jobs (`PR=`, `JOB=`, `TAIL=`) |
-| `devx-pr-label` | Add a label to a PR (`PR=`, `LABEL=ready-to-merge`) |
-| `devx-pr-review` | Post a review on a PR (`PR=`, `EVENT=`, `BODY=`, `CHECKLIST=`) |
-| `devx-check-config` | Validate devx configuration |
-| `devx-configure-gitea-pypi` | Configure Gitea private PyPI registry |
-| `devx-env` | Create .env from .env.example |
-| `devx-venv` | Create Python venv with version check |
-| `devx-activate-scripts` | Create shell/fish/zsh activate scripts |
-| `devx-install-hooks` | Set git hooks path to hooks/ |
-| `devx-install-tools` | Install actionlint, git-cliff, act_runner, tea, hadolint |
-| `devx-install-checkmake` | Install checkmake (Makefile linter) |
-| `devx-checkmake` | Lint Makefiles with checkmake |
-| `devx-workflow-lint` | Static lint of Gitea Actions YAML (actionlint) |
-| `devx-workflow-dryrun` | Dry-run all workflows (act_runner) |
-| `devx-workflow-dryrun-safe` | Best-effort dry-run (skips if act_runner missing) |
-| `devx-workflow-check` | Static lint + dry-run |
-| `devx-notify-failure` | Create Gitea issue on CI failure |
-| `devx-lint-ruff` | Run ruff check |
-| `devx-lint-format` | Run ruff format --check |
-| `devx-typecheck` | Run pyright |
-| `devx-lint-bandit` | Run bandit security scan |
-| `devx-lint-deps` | Check dependencies for vulnerabilities (pip-audit) |
-| `devx-lint` | Run all lint targets |
-| `devx-test-unit` | Run unit tests without coverage |
-| `devx-pytest-cov` | Run pytest with coverage enforcement |
-| `devx-check-mutable-globals` | Scan for mutable path globals |
-| `devx-check-dep-docs` | Validate pyproject.toml deps are documented |
-| `devx-check-test-coverage` | Check changed files have corresponding tests |
-| `devx-check-docs` | Validate docs for stale references |
-| `devx-check-test-speed` | Verify test suite timing |
-| `devx-pre-push` | Run lint + tests before push |
-| `devx-clean` | Remove caches, build artifacts, coverage data |
-| `devx-setup-image` | Link /opt/venv + install project (for pre-built image CI jobs) |
-| `devx-lint-dockerfiles` | Lint Dockerfiles with hadolint (fail-fast, parameterized by `DEVX_DOCKERFILE_PATHS`) |
-| `devx-build-images` | Build Docker images from manifest (no push) |
-| `devx-push-images` | Build and push Docker images to Gitea registry |
-| `devx-build-images-dry-run` | Show what would be built/pushed |
-| `devx-clean-images` | Delete old image versions (keep last 2 + latest) |
-
-**Variables** (set BEFORE including devx.mak):
- `DEVX_PYTHON` — Python executable (default: `python3`)
- `DEVX_VENV` — venv directory (default: `.venv`)
- `DEVX_BIN` — venv bin directory (default: `$(DEVX_VENV)/bin`)
- `DEVX_LINT_PATHS` — paths for ruff/bandit (default: `src/ tests/`)
- `DEVX_COV_PKG` — coverage package (default: `src/devx`)
- `DEVX_TEST_PATHS` — pytest paths (default: `tests/`)
- `DEVX_PR_BASE` — PR base branch (default: `master`)
- `DEVX_DOCKERFILE_PATHS` — directory to search for Dockerfiles (default: `docker`)
- `DEVX_GITEA_REGISTRY` — registry URL (default: `git.oblachno.oblachno.fyi`)
- `DEVX_IMAGE_MANIFEST` — path to JSON manifest (default: `docker/images.json`)
- `DEVX_IMAGE_OWNER` — package owner for cleanup (default: `oblachno-oss`)
-
-## Pre-built Docker Runner Images
-
-devx builds and publishes three tier images to the Gitea container registry
-to eliminate the 40-120s setup tax on every CI job:
-
-| Image | Contains | Used by jobs |
-|-------|----------|-------------|
-| `ci-base-latest` | Python 3.12 + devx[ci] + tea | auto-merge, detect-and-configure |
-| `ci-quality-latest` | ci-base + devx[lint] + actionlint + checkmake + hadolint | (badges in release-and-maintain uses ci-full) |
-| `ci-full-latest` | ci-quality + devx[release,molecule,deploy] + git-cliff + OpenTofu | validate, release-and-maintain, molecule-tests, build-and-push |
-
-**Build process** (in `build-images.yml` workflow):
-1. `ci-base` builds FROM `gitea/runner-images:ubuntu-latest`
-2. `ci-quality` builds FROM `ci-base-latest`
-3. `ci-full` builds FROM `ci-quality-latest`
-
-Each image is tagged `latest` and pushed to
-`git.oblachno.oblachno.fyi/oblachno-oss/runner-images:<tier>-latest`.
-
-**Using images in workflows**:
-```yaml
-jobs:
-  validate:
-    runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up environment
-        run: make setup-image  # links /opt/venv, installs project (no-deps)
-```
-
-**Image build/push tools** (tested Python modules):
- `devx.tools.build_image` — Build and push Docker images from Dockerfile or manifest
- `devx.tools.clean_images` — Delete old image versions via Gitea API (keep last N + latest)
-
-**Usage in project Makefile**:
-```makefile
-DEVX_PYTHON := $(BIN)/python
-DEVX_MAK := $(shell $(BIN)/python -c \
-    "from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
-    2>/dev/null)
-include $(DEVX_MAK)
-
-# Aliases for project-specific names
-lint-ruff: devx-lint-ruff
-workflow-lint: devx-workflow-lint
-create-task: devx-create-task
-```
-
-## Key Conventions
-
- Python 3.12+ required (ruff/pyright target `py312`)
- 100% test coverage required (`--cov-fail-under=100`)
- Conventional commits on feature branches (no `DEVX-N:` prefix)
- Branch names must include `DEVX-N` task ID
- Line length: 120 chars
- Secrets are passed via environment variables, never on the command line
- All user-facing strings wrapped in `_()` for i18n
-
-### Container-Level Fix Verification (Mandatory)
-
-**Rule:** Before pushing any fix that modifies container state (CA certs,
-config files, installed packages, daemon restarts), reproduce the exact
-sequence locally with the actual Docker image. Do not push to CI as the
-first test.
-
-This is a hard rule, not a suggestion. CI cycles take 20+ minutes and
-ephemeral staging VMs are destroyed after each run, making interactive
-debugging impossible. A local reproduction takes 30 seconds and catches
-silent failures immediately.
-
-**Procedure:**
-1. `docker pull <actual_image>`
-2. `docker run -d --name <test> ...` and wait for it to start
-3. Run the exact commands from the Ansible task or script
-4. Verify the state change took effect
-5. Clean up: `docker rm -f <test>`
-
-### Verified State Modification (Mandatory)
-
-Ansible tasks that modify container state with `changed_when: false`
-MUST include a post-task verification step that confirms the state
-change took effect. `changed_when: false` suppresses both change
-detection AND failure visibility — a task can silently do nothing and
-report `ok`.
-
-## Subagent Delegation Policy
-
-Custom subagent profiles are defined in `.devin/agents/` (project-specific)
-and `~/.config/devin/agents/` (global, shared across repos). The agent MUST
-automatically delegate to the appropriate subagent based on the task —
-the user should not need to specify which profile to use.
-
-### Available Profiles
-
-**Global** (shared across all projects):
-
-| Profile | Location | Purpose |
-|---------|----------|---------|
-| `pr-reviewer` | `~/.config/devin/agents/` | 13-category PR checklist + quality gates |
-| `release-check` | `~/.config/devin/agents/` | Pre-merge readiness validation |
-
-**devx-specific** (in `.devin/agents/`):
-
-| Profile | Purpose |
-|---------|---------|
-| `ci-investigator` | Investigate CI failures (validate, release-and-maintain, build-images) |
-| `dep-upgrader` | Python dependency upgrades in pyproject.toml with dep-doc validation |
-| `docker-image-builder` | Build/push/cleanup 3-tier runner images (ci-base, ci-quality, ci-full) |
-| `doc-sync-specialist` | Doc coverage, doc linting, wiki sync integrity |
-| `workflow-validator` | actionlint + act_runner dry-run validation |
-
-### When to Delegate Automatically
-
-| Trigger | Profile | Mode |
-|---------|---------|------|
-| CI run failure (validate, release-and-maintain, build-images) | `ci-investigator` | Background |
-| PR ready for review | `pr-reviewer` | Foreground |
-| Dependency upgrade requested | `dep-upgrader` | Background |
-| Docker image build/push needed | `docker-image-builder` | Background |
-| Doc coverage failure or wiki sync issue | `doc-sync-specialist` | Background |
-| Workflow YAML modified or validation needed | `workflow-validator` | Background |
-| Branch ready for merge | `release-check` | Foreground |
-
-### Delegation Rules
-
-1. **Auto-select the profile.** Do not ask the user which profile to use.
-2. **Background by default, foreground when blocking.**
-3. **Provide full context in the prompt** — subagents don't inherit conversation history.
-4. **One subagent per concern.** Chain: investigate → fix in main session → review.
-5. **Don't delegate minor work** (<30s, <50 lines of context).
-6. **Compact after subagent returns.**
-7. **Never skip delegation to save time** — it keeps main context small.
-
-
-## Feedback Issue Handling
-
-Subagents create Gitea issues in the current repo when they encounter
-tool, workflow, or process issues that warrant follow-up. These issues
-use the `feedback` label plus a category label (`tooling`,
-`ci-improvement`, `doc-improvement`, `workflow-improvement`).
-
-Standard labels are created automatically by `configure_repo` (runs in
-post-merge on every master push). If a label does not exist yet, the
-subagent's issue creation will still succeed — labels can be added
-afterwards.
-
-### When a Subagent Reports a Feedback Issue URL
-
-1. **Acknowledge it** in your response to the user — mention the issue URL
-2. **Do NOT close or modify** the issue — it is for follow-up work
-3. **Do NOT create a PR** to address it unless the user explicitly asks
-4. If the user asks to address feedback, spawn a subagent to investigate
-   the issue and implement a fix
-
-### Creating Feedback Issues Manually
-
-As the parent agent, you can also create feedback issues directly using
-the Gitea MCP (`issue_write` with `create_issue` method). Follow the
-same format as subagents:
-
- Title: `[feedback] <category>: <short description>`
- Labels: `feedback` + category label
- Body: include context, tool/workflow, issue, reproduction, affected
-  files, suggested investigation, and "Reported by: parent agent"
-
-Always deduplicate first via `list_issues` with `labels: "feedback"`.
-
@@ -1,845 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-## [0.48.1] - 2026-08-08
-
-### Bug Fixes
-
- *(setup)* Extract version from filename for mirror installs
-
-## [0.48.0] - 2026-08-08
-
-### Features
-
- *(setup)* Mirror Ansible collections from Gitea registry with auth
-
-## [0.47.10] - 2026-08-05
-
-### Bug Fixes
-
- Unique molecule container names per CI runner
-
-## [0.47.9] - 2026-08-03
-
-### Bug Fixes
-
- Unique molecule container names per CI runner
-
-## [0.47.8] - 2026-08-03
-
-### Bug Fixes
-
- Increase CI_SCALE_FACTOR default from 4 to 6
-
-## [0.47.7] - 2026-08-03
-
-### Bug Fixes
-
- Scale check_test_speed limits on CI runners
-
-## [0.47.6] - 2026-08-03
-
-### Bug Fixes
-
- Configure git auth in setup_image for git+https deps
-
-## [0.47.5] - 2026-08-03
-
-### Bug Fixes
-
- Push wiki to main branch instead of master
-
-## [0.47.4] - 2026-08-03
-
-### Bug Fixes
-
- Add User-Agent header to _download in install_tools
-
-## [0.47.3] - 2026-07-17
-
-### Bug Fixes
-
- Bake promtool into ci-full image, add download timeout, speed up tests
-
-## [0.47.2] - 2026-07-17
-
-### Bug Fixes
-
- Add retry logic to TeaCLI for transient HTTP errors (502/503/504/429)
-
-## [0.47.1] - 2026-07-16
-
-### Bug Fixes
-
- Tea CLI login failure handling, error messages, release retry
-
-## [0.47.0] - 2026-07-14
-
-### Features
-
- Add promtool to install_tools for alert rule validation
-
-## [0.46.0] - 2026-07-14
-
-### Features
-
- Make check_test_isolation configurable via pyproject.toml
-
-## [0.45.1] - 2026-07-14
-
-### Bug Fixes
-
- URL-encode package names and versions in clean_images API calls
-
-## [0.45.0] - 2026-07-14
-
-### Features
-
- Add IO_INTERNAL_CALLS to check_test_isolation
-
-## [0.44.2] - 2026-07-14
-
-### Bug Fixes
-
- Use legacy Docker builder to avoid Gitea registry 403
-
-## [0.44.1] - 2026-07-14
-
-### Bug Fixes
-
- Disable Docker buildx provenance attestation
-
-## [0.44.0] - 2026-07-13
-
-### Features
-
- Add fix_pr_title module and update_pr API method
-
-## [0.43.0] - 2026-07-13
-
-### Features
-
- Add get_customer_vm_ip and get_observability_vm_ip to I/O check
-
-## [0.42.0] - 2026-07-13
-
-### Features
-
- Add I/O function isolation check and skip integration tests
-
-## [0.41.2] - 2026-07-13
-
-### Bug Fixes
-
- Auto-discover molecule root instead of hardcoding gitea-runner
-
-## [0.41.1] - 2026-07-13
-
-### Bug Fixes
-
- Check_test_isolation accepts multiple --test-path values
-
-## [0.41.0] - 2026-07-13
-
-### Features
-
- Test isolation pytest plugin, shift-left quality gates, dep upgrades
-
-## [0.40.1] - 2026-07-12
-
-### Bug Fixes
-
- Fall back to CI token when reviewer self-approval is rejected
-
-## [0.40.0] - 2026-07-11
-
-### Features
-
- Detect double-prefix in Vikunja task title during pre-merge validation
-
-## [0.39.0] - 2026-07-09
-
-### Features
-
- Extract shared utilities from infra and grm into devx
-
-## [0.38.0] - 2026-07-08
-
-### Features
-
- Introduce role-based Gitea API token environment variables
-
-## [0.37.0] - 2026-07-07
-
-### Features
-
- Consolidate docs checks into devx-docs-check target
-
-## [0.36.2] - 2026-07-07
-
-### Bug Fixes
-
- GiteaClient.set_repo_variable uses PUT instead of PATCH
-
-## [0.36.1] - 2026-07-07
-
-### Bug Fixes
-
- Preserve .badges/ dir during git clean in push_badges
-
-## [0.36.0] - 2026-07-07
-
-### Features
-
- Add GiteaClient repo variable methods and parallelize pytest-cov
-
-## [0.35.7] - 2026-07-06
-
-### Bug Fixes
-
- Use Gitea wiki dash-marker filename convention
-
-## [0.35.6] - 2026-07-06
-
-### Bug Fixes
-
- Add delay before wiki verification to avoid race condition
-
-## [0.35.5] - 2026-07-06
-
-### Bug Fixes
-
- Embed token in wiki clone URL for push auth
-
-## [0.35.4] - 2026-07-06
-
-### Bug Fixes
-
- Configure git identity before commit in sync_wiki
-
-## [0.35.3] - 2026-07-06
-
-### Bug Fixes
-
- Replace --strict with --verify for sync_wiki
-
-## [0.35.2] - 2026-07-06
-
-### Bug Fixes
-
- Exclude .vale directory from lint_docs scanning
-
-## [0.35.1] - 2026-07-06
-
-### Refactor
-
- Rewrite sync_wiki.py to use git-based approach
-
-## [0.35.0] - 2026-07-06
-
-### Features
-
- Enrich lint_docs.py with single H1, max depth, line length, code block lang, orphan checks
-
-## [0.34.0] - 2026-07-06
-
-### Features
-
- Enhance documentation-as-code with badges, version refs, Vale
-
-## [0.33.4] - 2026-07-06
-
-### Refactor
-
- Remove project-specific references from devx
-
-## [0.33.3] - 2026-07-06
-
-### Bug Fixes
-
- Make wiki sync resilient to API timeouts and stale page lists
-
-## [0.33.2] - 2026-07-05
-
-### Bug Fixes
-
- Abort sync_wiki when list_wiki_pages fails
-
-## [0.33.1] - 2026-07-05
-
-### Bug Fixes
-
- Build images after post-merge publish, not on push
-
-## [0.33.0] - 2026-07-05
-
-### Features
-
- Add check_api_identity_checks, setup_ssh_key, and api utils
-
-## [0.32.1] - 2026-07-01
-
-### Bug Fixes
-
- Add missing i18n translations for new tools
-
-## [0.32.0] - 2026-07-01
-
-### Features
-
- Extract docker-login, tofu-ops, check-deps, install-tofu to Python tools
-
-## [0.31.0] - 2026-07-01
-
-### Features
-
- Centralize venv management in devx.mak
-
-## [0.30.0] - 2026-07-01
-
-### Features
-
- Add standard label creation to configure_repo
-
-## [0.29.1] - 2026-07-01
-
-### Bug Fixes
-
- Strip task ID prefix from commit messages in extract_conventional_msg
-
-## [0.29.0] - 2026-07-01
-
-### Features
-
- Detect badge commits as automated CI commits
-
-## [0.28.0] - 2026-07-01
-
-### Features
-
- Auto-rebase in auto-merge, new rebase tools, CLI registration
-
-## [0.27.3] - 2026-06-30
-
-### Bug Fixes
-
- Retry wiki integrity check on transient API timeout
-
-## [0.27.2] - 2026-06-29
-
-### Bug Fixes
-
- Retry release push on non-fast-forward with rebase loop
-
-## [0.27.1] - 2026-06-28
-
-### Bug Fixes
-
- Exclude .devin/.terraform dirs from lint_docs, add duplicate heading excludes
-
-## [0.27.0] - 2026-06-28
-
-### Features
-
- Add lint_docs tool, fix doc_coverage/check_translations for any repo
-
-## [0.26.4] - 2026-06-28
-
-### Bug Fixes
-
- Wrap all user-facing strings with _() for i18n completeness
-
-## [0.26.3] - 2026-06-28
-
-### Bug Fixes
-
- Pin all dependencies to exact versions for reproducibility
-
-## [0.26.2] - 2026-06-28
-
-### Bug Fixes
-
- Block admin merge override and auto-approve with review token
-
-## [0.26.1] - 2026-06-28
-
-### Bug Fixes
-
- Force pip upgrade in setup-image to install new dependencies
-
-## [0.26.0] - 2026-06-28
-
-### Features
-
- Add distribute_items CI tool for parallel VM deployment
-
-## [0.25.0] - 2026-06-28
-
-### Features
-
- Add manual review support to pr_review (--event, --body, --checklist-confirmed)
-
-## [0.24.1] - 2026-06-28
-
-### Refactor
-
- Add find_task_by_identifier, config fallbacks for tools
-
-## [0.24.0] - 2026-06-27
-
-### Features
-
- Add pr_status, pr_logs, pr_label tools
-
-## [0.23.4] - 2026-06-27
-
-### Bug Fixes
-
- Add --auto-login to all notify_failure calls in workflows
- Classify .gitea/** as user-facing for devx, support glob in user_facing_overrides
-
-## [0.23.3] - 2026-06-27
-
-### Bug Fixes
-
- Correct clean_images delete URL and add retry with error handling
-
-## [0.23.2] - 2026-06-27
-
-### Bug Fixes
-
- Add skip-ci flag to release commits and concurrency to build-images
-
-## [0.23.1] - 2026-06-27
-
-### Bug Fixes
-
- Add rsync to ci-full image for molecule_docker
-
-## [0.23.0] - 2026-06-27
-
-### Features
-
- Add devx-lint-dockerfiles to devx.mak, alias setup-image
-
-### Refactor
-
- Remove hadolint on-the-fly install from setup-image
-
-## [0.22.1] - 2026-06-27
-
-### Bug Fixes
-
- Checkout release tag in publish job
- Fail lint-dockerfiles when hadolint is missing
-
-## [0.22.0] - 2026-06-27
-
-### Features
-
- Document CI_GITEA_TOKEN scopes and add CI_GITEA_USERNAME to env var table
-
-## [0.21.2] - 2026-06-27
-
-### Bug Fixes
-
- Gate auto-merge on release-dry-run and unmask failures
-
-## [0.21.1] - 2026-06-27
-
-### Bug Fixes
-
- Devx-setup-image configures Gitea PyPI registry and shows pip errors
-
-## [0.21.0] - 2026-06-27
-
-### Features
-
- Add --auto-login to publish, extract configure_tea_login to gitea_cli
-
-### Bug Fixes
-
- Publish job uses setup-release for build + tea login
- Remove tag fallback step from release workflow
-
-## [0.20.3] - 2026-06-27
-
-### Bug Fixes
-
- Release publish failures and duplicate release commits
-
-## [0.20.2] - 2026-06-27
-
-## [0.20.2] - 2026-06-27
-
-### Bug Fixes
-
- Correct sed substitution in ci-full Dockerfile
-
-## [0.20.1] - 2026-06-27
-
-### Bug Fixes
-
- Correct image references in tier Dockerfiles
-
-## [0.20.0] - 2026-06-27
-
-### Features
-
- Add pre-built Docker runner images and tested image build/push tools
-
-## [0.19.3] - 2026-06-26
-
-### Refactor
-
- Make molecule weights configurable via pyproject.toml
-
-## [0.19.2] - 2026-06-26
-
-### Bug Fixes
-
- Calibrate molecule weights from actual CI execution times
-
-## [0.19.1] - 2026-06-26
-
-### Refactor
-
- Consolidate publish.yml into post-merge.yml
-
-## [0.19.0] - 2026-06-26
-
-### Features
-
- Add skip_ref_prefixes config to check_agent_docs
-
-## [0.18.0] - 2026-06-26
-
-### Features
-
- Extract generic tools into devx, expand devx.mak, remove personal references
-
-## [0.17.0] - 2026-06-26
-
-### Features
-
- Weighted LPT distribution, workflow fixes, decouple vikunja/sync-wiki from release
-
-## [0.16.0] - 2026-06-26
-
-### Features
-
- Single-source-of-truth config via [tool.devx] in pyproject.toml
-
-## [0.15.0] - 2026-06-26
-
-### Features
-
- Add create-task, create-pr, pre-push-check tools and devx.mak fragment
-
-## [0.14.2] - 2026-06-26
-
-### Bug Fixes
-
- Make repo arg optional in publish CLI, auto-detect from GITHUB_REPOSITORY
-
-## [0.14.1] - 2026-06-25
-
-### Bug Fixes
-
- Handle 'already a release' error idempotently in publish
-
-## [0.14.0] - 2026-06-25
-
-### Features
-
- Add FORCE_DEPLOY env var, --git flag, --from-tag flag
-
-## [0.13.0] - 2026-06-25
-
-### Features
-
- Add --force flag to classify_changes, fix api_clients coverage
-
-### Bug Fixes
-
- Squash-merge format uses space not colon after task ID
- Revert squash-merge format to use colon after task ID
-
-## [0.1.0] - 2026-06-25
-
-## [0.12.5] - 2026-06-25
-
-### Bug Fixes
-
- Make PyPI publish failures non-fatal
-
-## [0.12.4] - 2026-06-25
-
-### Bug Fixes
-
- Pass REPO_TOKEN to setup-release so tea login is configured
- Guarantee Gitea release for every tag
-
-## [0.12.3] - 2026-06-25
-
-### Refactor
-
- Remove JUnit reporting from devx
-
-## [0.12.2] - 2026-06-25
-
-### Bug Fixes
-
- Remove auto-rebase from auto-merge to prevent CI feedback loop
-
-## [0.12.1] - 2026-06-25
-
-### Bug Fixes
-
- Use heredoc syntax for multi-line $GITHUB_ENV values
-
-## [0.12.0] - 2026-06-24
-
-### Features
-
- Add Polish as officially supported language
-
-## [0.11.1] - 2026-06-24
-
-### Bug Fixes
-
- Add build/twine to ci deps, activate venv in notify_failure
-
-## [0.11.0] - 2026-06-24
-
-### Features
-
- Add publish step to post-merge release job, make publish idempotent
-
-## [0.10.2] - 2026-06-24
-
-### Bug Fixes
-
- Badge generation respects pyproject.toml testpaths, shows stdout in warnings
-
-## [0.10.1] - 2026-06-24
-
-### Bug Fixes
-
- Badge generation REPO_ROOT, auto-detect package, error feedback
-
-## [0.10.0] - 2026-06-24
-
-### Features
-
- Remove .taskid file fallback, use branch name only
-
-### Bug Fixes
-
- Use raw/branch/badges/ URLs for badges in README and docs
-
-## [0.9.12] - 2026-06-24
-
-### Bug Fixes
-
- Clean dist/ before build and add workflow_dispatch to publish
-
-## [0.9.11] - 2026-06-24
-
-### Bug Fixes
-
- Use raw/branch/badges/ URLs for badges in README and docs
- Resolve repo_root from GITHUB_WORKSPACE or cwd
-
-## [0.9.10] - 2026-06-24
-
-### Bug Fixes
-
- Retrospective fixes for CI/CD friction
-
-## [0.9.9] - 2026-06-24
-
-### Bug Fixes
-
- Use DOCKER_HOST env var in is_docker_ready + scan all rootless sockets
- Prefer branch name for task ID extraction + strip heads/ prefix in release
- Filter non-version tags in release verification
- Use explicit refspecs for git push to avoid tag/branch ambiguity
-
-## [0.9.8] - 2026-06-24
-
-### Bug Fixes
-
- Use DOCKER_HOST env var in is_docker_ready + scan all rootless sockets
-
-## [0.9.7] - 2026-06-24
-
-### Bug Fixes
-
- Add rootless socket fallback and GITHUB_ENV export
-
-## [0.9.6] - 2026-06-24
-
-### Bug Fixes
-
- Add Docker socket diagnostics to start_docker
- Add Docker socket diagnostics to start_docker
-
-## [0.9.5] - 2026-06-24
-
-### Bug Fixes
-
- Use host Docker socket with DOCKER_HOST fallback to local dockerd
- Use host Docker socket with DOCKER_HOST fallback to local dockerd
-
-## [0.9.4] - 2026-06-24
-
-### Bug Fixes
-
- Use separate Docker socket for DinD in CI
-
-## [0.9.3] - 2026-06-24
-
-### Bug Fixes
-
- Use tempfile for dockerd log to fix CI permission error
-
-## [0.9.2] - 2026-06-24
-
-### Bug Fixes
-
- Use vfs storage driver for Docker-in-Docker in CI
-
-## [0.9.1] - 2026-06-23
-
-### Bug Fixes
-
- Always start dockerd in CI runner for molecule tests
-
-## [0.9.0] - 2026-06-23
-
-### Features
-
- Extract Docker daemon start to tested Python module
-
-## [0.8.5] - 2026-06-23
-
-### Bug Fixes
-
- Retry pip install with --ignore-installed only on failure
-
-## [0.8.4] - 2026-06-23
-
-### Bug Fixes
-
- Add --ignore-installed to pip in CI to bypass debian packages
-
-## [0.8.3] - 2026-06-23
-
-### Bug Fixes
-
- Lower check_test_speed threshold to 4 seconds
- Pass --break-system-packages to pip in CI environments
-
-## [0.8.2] - 2026-06-23
-
-### Bug Fixes
-
- Encode spaces in pair commands to survive shell word-splitting
-
-## [0.8.1] - 2026-06-23
-
-### Bug Fixes
-
- Set fresh MOLECULE_HOME per pair to avoid stale config cache
-
-## [0.8.0] - 2026-06-23
-
-### Features
-
- Fix molecule platforms to use sleep infinity, add --platforms-file
-
-## [0.7.0] - 2026-06-23
-
-### Features
-
- Add per-test timing quality gate to check_test_speed
-
-## [0.6.0] - 2026-06-23
-
-### Features
-
- Add opentofu helpers, CLI entry points, shared utility, and CI improvements
-
-## [0.5.0] - 2026-06-23
-
-### Features
-
- Add tag verification, idempotency, and --verify mode to release script
-
-## [0.4.4] - 2026-06-22
-
-### Bug Fixes
-
- Configurable task prefix and CWD-relative DOCS_DIR
-
-## [0.4.3] - 2026-06-22
-
-### Bug Fixes
-
- Expand DEFAULT_INFRASTRUCTURE to cover all common project files
-
-## [0.4.2] - 2026-06-22
-
-### Bug Fixes
-
- Make all warnings into errors across devx tools
-
-## [0.4.1] - 2026-06-22
-
-### Bug Fixes
-
- Correct version tags, changelog, and release script recovery
-
-## [0.4.0] - 2026-06-22
-
-### Features
-
- Add DEFAULT_INFRASTRUCTURE and configurable task prefix
-
-## [0.3.0] - 2026-06-22
-
-### Features
-
- Add --no-ansible-collections option to setup tool
-
-## [0.2.0] - 2026-06-22
-
-### Features
-
- Pluggable change classification framework
-
-## [0.1.2] - 2026-06-22
-
-### Bug Fixes
-
- Make sync-wiki and vikunja depend on release
-
-## [0.1.1] - 2026-06-22
-
-### Bug Fixes
-
- Disable push whitelist, allow direct pushes to master
-
-## [0.1.0] - 2026-06-22
-
-### Features
-
- Extract reusable dev/CI tools from GRM into devx package
-
-### Bug Fixes
-
- Use python3 and venv python in workflows and Makefile
- Fix post-merge job failures (configure-repo, badges, notify-failure)
- Allow release bot to push to protected master
@@ -1,232 +0,0 @@
-GNU GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
-
-Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
-
-Preamble
-
-The GNU General Public License is a free, copyleft license for software and other kinds of works.
-
-The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
-
-When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
-
-To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
-
-For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
-
-Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
-
-For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
-
-Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
-
-Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
-
-The precise terms and conditions for copying, distribution and modification follow.
-
-TERMS AND CONDITIONS
-
-0. Definitions.
-
-“This License” refers to version 3 of the GNU General Public License.
-
-“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
-
-“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
-
-To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
-
-A “covered work” means either the unmodified Program or a work based on the Program.
-
-To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
-
-To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
-
-An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
-
-1. Source Code.
-The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
-
-A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
-
-The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
-
-The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
-
-The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
-
-The Corresponding Source for a work in source code form is that same work.
-
-2. Basic Permissions.
-All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
-
-You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
-
-Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
-
-3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
-
-When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
-
-4. Conveying Verbatim Copies.
-You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
-
-You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
-
-5. Conveying Modified Source Versions.
-You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
-
-     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
-
-     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
-
-     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
-
-     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
-
-A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
-
-6. Conveying Non-Source Forms.
-You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
-
-     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
-
-     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
-
-     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
-
-     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
-
-     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
-
-A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
-
-A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
-
-“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
-
-If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
-
-The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
-
-Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
-
-7. Additional Terms.
-“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
-
-When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
-
-Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
-
-     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
-
-     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
-
-     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
-
-     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
-
-     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
-
-     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
-
-All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
-
-If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
-
-Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
-
-8. Termination.
-You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
-
-However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
-
-Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
-
-Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
-
-9. Acceptance Not Required for Having Copies.
-You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
-
-10. Automatic Licensing of Downstream Recipients.
-Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
-
-An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
-
-You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
-
-11. Patents.
-A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
-
-A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
-
-Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
-
-In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
-
-If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
-
-If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
-
-A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
-
-Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
-
-12. No Surrender of Others' Freedom.
-If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
-
-13. Use with the GNU Affero General Public License.
-Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
-
-14. Revised Versions of this License.
-The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
-
-If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
-
-Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
-
-15. Disclaimer of Warranty.
-THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-16. Limitation of Liability.
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-17. Interpretation of Sections 15 and 16.
-If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
-
-END OF TERMS AND CONDITIONS
-
-How to Apply These Terms to Your New Programs
-
-If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
-
-To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
-
-     devx
-     Copyright (C) 2026  oblachno-oss
-
-     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
-
-     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
-
-     devx  Copyright (C) 2026  oblachno-oss
-     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
-
-You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
-
-The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.
@@ -1,148 +0,0 @@
-.PHONY: all setup setup-ci setup-quality setup-release setup-image install update lint lint-all lint-dockerfiles test test-unit pytest-cov clean install-tools install-hooks activate-scripts checkmake check-mutable-globals check-dep-docs check-test-speed build-images push-images build-images-dry-run clean-images
-
-PYTHON := python3
-VENV := .venv
-BIN := $(VENV)/bin
-
-all: setup
-
-# --- devx.mak integration ----------------------------------------------------
-# Include shared targets from the devx package itself (venv management,
-# workflow-lint, notify-failure, checkmake, lint targets, quality checks, etc.)
-# Since devx IS the package, we can include its own devx.mak.
-DEVX_PYTHON := $(BIN)/python
-DEVX_VENV := $(VENV)
-DEVX_BIN := $(BIN)
-DEVX_LINT_PATHS := src/ tests/
-DEVX_COV_PKG := src/devx
-DEVX_TEST_PATHS := tests/
-
-DEVX_MAK := $(shell $(BIN)/python -c \
-	"from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
-	2>/dev/null)
-# Fallback: when the venv doesn't exist yet (chicken-and-egg), use the
-# source tree copy directly. devx IS the package, so src/devx/make/devx.mak
-# is always available in this repo.
-ifeq ($(strip $(DEVX_MAK)),)
-DEVX_MAK := $(CURDIR)/src/devx/make/devx.mak
-endif
-include $(DEVX_MAK)
-
-# venv, .env, and activate-scripts are provided by devx.mak
-# (devx-venv, devx-env, devx-activate-scripts, $(DEVX_VENV)/bin/activate rule)
-# Aliases for convenience and backward compatibility:
-.PHONY: venv activate-scripts
-venv: devx-venv
-.env: devx-env
-activate-scripts: devx-activate-scripts
-
-# Full setup for local development
-setup: $(VENV)/bin/activate .env activate-scripts install-tools
-	@$(BIN)/pip install -e '.[dev]' 2>/dev/null; \
-	export PATH="$(HOME)/.local/bin:$$PATH"; \
-	$(BIN)/python -m devx.tools.setup --bin "$(BIN)"
-
-# Lean setup for CI jobs (pytest + lint + runtime deps)
-setup-ci: $(VENV)/bin/activate .env
-	@$(BIN)/pip install -e '.[ci,lint]' 2>/dev/null; \
-	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --extras "ci,lint" --no-pre-commit --no-tea-login
-
-# Setup for quality job (lint + test deps, actionlint tool)
-setup-quality: $(VENV)/bin/activate .env install-tools
-	@$(BIN)/pip install -e '.[ci,lint]' 2>/dev/null; \
-	export PATH="$(HOME)/.local/bin:$$PATH"; \
-	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --extras "ci,lint" --no-pre-commit --no-tea-login
-
-# Setup for release jobs (needs git-cliff, tea, lint tools)
-setup-release: $(VENV)/bin/activate .env
-	@$(BIN)/pip install -e '.[ci,lint,release]' 2>/dev/null; \
-	$(BIN)/python -m devx.tools.install_tools --tool git-cliff --tool tea; \
-	export PATH="$(HOME)/.local/bin:$$PATH"; \
-	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --extras "ci,lint,release" --no-pre-commit
-
-# Setup for pre-built image jobs (deps already in image, just link venv + install project)
-# Note: Not aliased to devx-setup-image because devx's own CI images may have
-# an older devx.mak that doesn't yet define devx-setup-image. Consumer repos
-# (grm, infra) can safely alias to devx-setup-image since they install devx from PyPI.
-setup-image:
-	@if [ -d /opt/venv ]; then ln -sf /opt/venv $(VENV); . $(VENV)/bin/activate && pip install --no-cache-dir -e . 2>/dev/null; \
-	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
-
-install-hooks:
-	@cp hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
-	@cp hooks/pre-push .git/hooks/pre-push && chmod +x .git/hooks/pre-push
-	@echo "Git hooks installed."
-
-install-tools: $(VENV)/bin/activate
-	@$(BIN)/pip install -e '.' 2>/dev/null; \
-	$(BIN)/python -m devx.tools.install_tools
-
-# Aliases — project-specific names map to devx.mak targets
-.PHONY: lint-ruff lint-format typecheck lint-bandit lint-deps lint
-.PHONY: workflow-lint workflow-dryrun workflow-dryrun-safe workflow-check
-.PHONY: notify-failure checkmake check-mutable-globals check-dep-docs
-.PHONY: check-test-speed check-test-coverage check-docs check-test-isolation check-translations
-.PHONY: create-task create-pr push-with-pr git-push rebase pr-rebase
-.PHONY: lint-all lint-dockerfiles
-lint-ruff: devx-lint-ruff
-lint-format: devx-lint-format
-typecheck: devx-typecheck
-lint-bandit: devx-lint-bandit
-lint-deps: devx-lint-deps
-lint: devx-lint
-workflow-lint: devx-workflow-lint
-workflow-dryrun: devx-workflow-dryrun
-workflow-dryrun-safe: devx-workflow-dryrun-safe
-workflow-check: devx-workflow-check
-notify-failure: devx-notify-failure
-checkmake: devx-checkmake
-check-mutable-globals: devx-check-mutable-globals
-check-dep-docs: devx-check-dep-docs
-check-test-speed: devx-check-test-speed
-check-test-isolation: devx-check-test-isolation
-check-translations: devx-check-translations
-check-test-coverage: devx-check-test-coverage
-check-docs: devx-check-docs
-create-task: devx-create-task
-create-pr: devx-create-pr
-push-with-pr: devx-push-with-pr
-git-push: devx-push
-rebase: devx-rebase
-pr-rebase: devx-pr-rebase
-
-lint-all: lint workflow-lint lint-dockerfiles
-	@echo "[lint-all] All linting checks passed."
-
-# Note: Not aliased to devx-lint-dockerfiles for the same reason as setup-image —
-# devx's own CI images may have an older devx.mak. Consumer repos can safely alias.
-lint-dockerfiles:
-	@echo "[lint-dockerfiles] Linting Dockerfiles with hadolint..."
-	@command -v hadolint >/dev/null 2>&1 || { echo "hadolint not found" >&2; exit 1; }
-	@find docker -name 'Dockerfile*' -exec hadolint {} +
-	@echo "[lint-dockerfiles] All Dockerfiles passed."
-
-test-unit: devx-test-unit
-
-pytest-cov: devx-pytest-cov
-
-test: pytest-cov
-
-pre-push: lint-all pytest-cov
-	@echo "[pre-push] All checks passed. Proceeding with push."
-
-clean: devx-clean
-	@echo "[clean] Done."
-
-# ── Docker image management ──────────────────────────────────────────────────
-
-build-images: devx-build-images
-	@echo "[build-images] Done."
-
-push-images: devx-push-images
-	@echo "[push-images] Done."
-
-build-images-dry-run: devx-build-images-dry-run
-	@echo "[build-images-dry-run] Done."
-
-clean-images: devx-clean-images
-	@echo "[clean-images] Done."
@@ -1,476 +0,0 @@
-# devx — Reusable Development & CI/CD Tools
-
-A Python package providing reusable development and CI/CD automation tools for
-oblachno-oss projects. devx consolidates release management, PR automation,
-wiki sync, badge generation, translation checks, documentation coverage,
-parallel test distribution, and more into a single installable package.
-
-It was extracted from the [GRM](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
-project to be reusable across all oblachno-oss repositories. Any project hosted
-on a Gitea instance with Gitea Actions can install devx and inherit a complete,
-opinionated CI/CD pipeline: conventional commits, automated versioning via
-git-cliff, squash-merge automation, Vikunja task tracking, wiki sync, and
-quality badges.
-
-> An open-source project from **Oblachno** (облачно means *cloudy* in Bulgarian).
-
-[![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/python.svg)](https://www.python.org/downloads/)
-
-## Why devx?
-
-Every oblachno-oss project shares the same CI/CD needs: automated releases,
-PR review, task tracking, documentation sync, and quality badges. Without a
-shared package, each repository duplicates this logic in shell scripts and
-workflow YAML, leading to drift, bugs, and maintenance burden.
-
-devx solves this by providing a single, tested Python package that any
-oblachno-oss project can install. The project declares its configuration via
-environment variables and `pyproject.toml`, and devx handles the rest. Updates
-to the CI/CD pipeline ship as new devx releases — consumer projects pick them
-up by bumping their devx dependency.
-
-### Key features
-
- **Automated releases** — git-cliff-driven semver versioning, changelog
-  generation, tagging, and publishing to a Gitea PyPI registry.
- **PR automation** — squash-merge with task ID validation, automated PR
-  review with inline comments, and conventional commit enforcement.
- **Smart change classification** — user-facing vs workflow-only change
-  detection so infrastructure-only changes skip releases.
- **Documentation sync** — push `docs/` markdown to the Gitea wiki with
-  integrity verification.
- **Quality badges** — generate self-contained SVG badges for coverage,
-  tests, docs, quality, version, and Python version.
- **Translation checks** — validate i18n keys against source code, detect
-  dead keys and missing languages.
- **Parallel test distribution** — split test files or molecule scenarios
-  across CI runners with cross-runner fail-fast.
- **Developer tools** — environment setup, CI tool installation, test speed
-  enforcement, repository configuration.
- **i18n** — built-in translations for English, Bulgarian, German, Russian,
-  Chinese, and Polish; projects can extend with their own keys.
-
-## Installation
-
-devx is published to the Gitea PyPI registry at
-`https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple`.
-The registry is publicly readable — no authentication required to install.
-
-### Quick install (one-off)
-
-```bash
-pip install devx --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
-```
-
-### Persistent configuration (recommended)
-
-Add the registry to `~/.pip/pip.conf` so `pip install devx` works without
-specifying `--index-url` every time:
-
-```ini
-[global]
-extra-index-url = https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
-```
-
-### As a dependency in another project
-
-To use devx as a dependency in your `pyproject.toml`, add the registry as an
-extra index and list devx in your dependencies:
-
-```toml
-[project]
-dependencies = [
-    "devx>=0.48.1",
-]
-
-[tool.pip]
-extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
-```
-
-Then install normally:
-
-```bash
-pip install -e .
-```
-
-> **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.48.1"`) or use a version constraint
-> (for example, `"devx>=0.48.1,<0.49"`).
-
-### Optional extras
-
-devx ships optional dependency groups for different use cases:
-
-```bash
-pip install "devx[ci,lint]"      # CI runners and linting (pytest, ruff, pyright, bandit, build, twine)
-pip install "devx[molecule]"     # Molecule testing for Ansible projects
-pip install "devx[dev]"          # Full local development (ci + lint + build + twine)
-```
-
-## Quick start
-
-After installing devx, set the required environment variables (see
-[Configuration](#configuration)) and invoke modules via `python -m devx.*` or
-the `devx` CLI.
-
-### CI/CD automation
-
-CI/CD modules are invoked via `python -m devx.ci.*`. Each module is also
-available as a `devx ci <command>` subcommand.
-
-```bash
-# Release automation (versioning, changelog, tagging)
-python -m devx.ci.release
-python -m devx.ci.release --dry-run          # preview without changes
-python -m devx.ci.release --verify           # check tag/version/changelog alignment
-
-# Publish a release to the Gitea PyPI registry
-python -m devx.ci.publish v1.0.0 oblachno-oss/devx
-python -m devx.ci.publish v1.0.0 oblachno-oss/devx --skip-build  # Gitea release only
-
-# Automated PR review (posts inline comments and structured review)
-python -m devx.ci.pr_review 42 oblachno-oss/devx
-
-# Auto-merge a PR (validates title, squash-merges)
-python -m devx.ci.auto_merge feature-branch "DEVX-12: Add feature" oblachno-oss/devx 42
-
-# Classify changes (user-facing vs workflow-only)
-python -m devx.ci.classify_changes --base origin/master --head HEAD --github-output
-
-# Sync documentation to Gitea wiki
-python -m devx.ci.sync_wiki --repo oblachno-oss/devx --strict
-
-# Generate and push quality badges
-python -m devx.ci.push_badges
-python -m devx.ci.push_badges --retries 3     # retry on git push failures
-
-# Check translation completeness
-python -m devx.ci.check_translations
-python -m devx.ci.check_translations --translations path/to/translations.json
-
-# Documentation coverage check
-python -m devx.ci.doc_coverage --fail-on-missing
-
-# Documentation lint (structure, links, headings, TODOs)
-python -m devx.ci.lint_docs --root .
-
-# Validate a commit message
-python -m devx.ci.validate_commit_msg commit-msg.txt --branch master
-
-# Detect whether the latest commit is a release commit
-python -m devx.ci.detect_release_commit
-
-# Notify on CI failure (creates a Gitea issue)
-python -m devx.ci.notify_failure --repo oblachno-oss/devx --run-id 123 \
-  --workflow ci --commit abc123 --auto-login
-
-# Discover available Gitea Actions runners
-python -m devx.ci.discover_runners --owner oblachno-oss --repo devx --indices
-
-# Distribute files across parallel runners (round-robin)
-python -m devx.ci.distribute_files --pattern "tests/integration/test_*.py" \
-  --runner-index 1 --max-runners 3 --github-env
-
-# Run pytest with cross-runner fail-fast
-python -m devx.ci.integration_guard -- test_a.py test_b.py
-```
-
-### Developer tools
-
-Developer tooling modules are invoked via `python -m devx.tools.*` or the
-`devx tools <command>` subcommand.
-
-```bash
-# Set up a development environment (venv, deps, hooks, tea login)
-python -m devx.tools.setup --bin .venv/bin
-python -m devx.tools.setup --bin .venv/bin --extras "ci,lint" --no-pre-commit
-
-# Install CI tools (actionlint, git-cliff, act_runner, tea)
-python -m devx.tools.install_tools
-python -m devx.tools.install_tools --tool git-cliff --tool tea
-python -m devx.tools.install_tools --list
-
-# Install checkmake (Makefile linter)
-python -m devx.tools.install_checkmake
-
-# Check unit test speed
-python -m devx.tools.check_test_speed --max-seconds 10
-python -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
-
-# Configure repository (branch protection, labels)
-python -m devx.tools.configure_repo --repo devx --owner oblachno-oss
-
-# Generate badge SVG files locally
-python -m devx.tools.generate_badges --output-dir .badges/
-
-# Generate a cliff.toml with the correct task ID prefix
-python -m devx.tools.generate_cliff_config --prefix GRM
-python -m devx.tools.generate_cliff_config --prefix GRM --force  # overwrite existing
-```
-
-### Molecule testing (optional)
-
-For projects with Ansible roles, devx provides molecule testing helpers via
-`python -m devx.molecule.*` or `devx molecule <command>`.
-
-```bash
-# Distribute molecule scenarios across parallel runners
-python -m devx.molecule.distribute_molecule --runner-index 1 --max-runners 3
-python -m devx.molecule.distribute_molecule --list              # list all scenarios
-python -m devx.molecule.distribute_molecule --list-platforms    # list platforms
-
-# Run molecule tests with cross-runner fail-fast
-python -m devx.molecule.molecule_ci_guard pair1 pair2
-python -m devx.molecule.molecule_ci_guard --roles-root ansible/roles pair1 pair2
-
-# Run all molecule scenarios locally (sequential)
-python -m devx.molecule.molecule_all
-python -m devx.molecule.molecule_all --bin .venv/bin
-
-# Discover available Gitea Actions runners for molecule tests
-python -m devx.molecule.discover_runners --indices
-
-# Ensure Docker is available for molecule tests in CI
-python -m devx.molecule.start_docker
-```
-
-### OpenTofu helpers
-
-devx provides reusable functions for extracting values from `tofu output`:
-
-```python
-from devx.opentofu import get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field
-
-vms = get_tofu_output("customer_vms", cwd="tofu/environments/staging",
-                      env={"HCLOUD_TOKEN": token})
-ip = get_tofu_vm_ip("customer_vms", "oblachno", cwd="tofu/environments/staging",
-                    env={"HCLOUD_TOKEN": token})
-```
-
-## CLI commands overview
-
-devx provides a `devx` CLI command with three command groups:
-
-```bash
-devx --help
-devx --version
-```
-
-### `devx ci` — CI/CD automation
-
-| Command | Description |
-|---------|-------------|
-| `devx ci auto-merge` | Squash-merge a PR with task ID validation |
-| `devx ci check-translations` | Check translation files for gaps and dead keys |
-| `devx ci classify-changes` | Classify git changes as user-facing or workflow-only |
-| `devx ci detect-release-commit` | Detect whether the latest commit is a release commit |
-| `devx ci discover-runners` | Discover available Gitea Actions runners |
-| `devx ci distribute-files` | Distribute files across parallel runners (round-robin) |
-| `devx ci doc-coverage` | Check documentation coverage for CLI commands and modules |
-| `devx ci integration-guard` | Run pytest with cross-runner fail-fast |
-| `devx ci notify-failure` | Create a Gitea issue when a CI workflow fails |
-| `devx ci post-merge` | Update Vikunja task after a merge to master |
-| `devx ci pr-review` | Run automated PR review |
-| `devx ci publish` | Build package, publish to registry, create Gitea release |
-| `devx ci push-badges` | Generate badge SVG files and push to the badges branch |
-| `devx ci release` | Automated release: version, changelog, tag, push |
-| `devx ci sync-wiki` | Sync documentation from docs/ to the Gitea wiki |
-| `devx ci validate-commit-msg` | Validate commit messages for conventional format |
-
-### `devx tools` — Developer tools
-
-| Command | Description |
-|---------|-------------|
-| `devx tools check-test-speed` | Run unit tests and enforce execution-time budgets |
-| `devx tools configure-repo` | Configure branch protection and labels via Gitea API |
-| `devx tools generate-badges` | Generate self-contained SVG badge files |
-| `devx tools generate-cliff-config` | Generate a cliff.toml with the correct task ID prefix |
-| `devx tools install-checkmake` | Install checkmake (Makefile linter) |
-| `devx tools install-tools` | Install actionlint, git-cliff, act_runner, tea |
-| `devx tools setup` | Project setup: install deps, hooks, tea login |
-
-### `devx molecule` — Molecule testing (optional)
-
-| Command | Description |
-|---------|-------------|
-| `devx molecule all` | Run all molecule scenarios on all supported platforms |
-| `devx molecule discover-runners` | Discover available Gitea Actions runners |
-| `devx molecule distribute` | Distribute molecule test pairs across parallel runners |
-| `devx molecule guard` | Run molecule tests with CI failure polling |
-
-See [CLI Commands](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/CLI-Commands)
-in the wiki for full command documentation with examples.
-
-## Configuration
-
-devx reads configuration from environment variables with `.env` file fallback.
-The config system loads `.env` automatically via `python-dotenv`.
-
-### DEVX_ environment variables
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `DEVX_GITEA_API_URL` | `https://git.oblachno.oblachno.fyi/api/v1` | Gitea API base URL |
-| `DEVX_VIKUNJA_API_URL` | `https://work.oblachno.oblachno.fyi/api/v1` | Vikunja API base URL |
-| `DEVX_REPO_OWNER` | **(none — must be set)** | Repository owner for API calls |
-| `DEVX_REPO_NAME` | **(none — must be set)** | Repository name (or `owner/repo`) |
-| `DEVX_TASK_PREFIX` | `DEVX` | Task ID prefix (GRM, OBL-INFRA, etc.) |
-| `DEVX_VIKUNJA_PROJECT_ID` | `6` | Vikunja project ID |
-| `DEVX_LANG` | `en` | Language for i18n (en, bg, de, ru, zh, pl) |
-| `DEVX_TRANSLATIONS_PATH` | — | Path to a custom JSON translations file |
-| `DEVX_VERSION_FILE` | `src/devx/__init__.py` | Version source file (used by release) |
-| `DEVX_DOCS_DIR` | `docs` | Documentation directory (used by sync_wiki) |
-| `DEVX_STATUS_CHECKS` | `CI / quality (pull_request)` | Comma-separated status check contexts |
-| `DEVX_PYPI_REGISTRY_URL` | — | Gitea PyPI registry URL (used by publish) |
-| `CI_GITEA_TOKEN` | — | Gitea API token (see scopes below) |
-| `CI_GITEA_USERNAME` | — | Gitea username for registry authentication |
-| `VIKUNJA_TOKEN` | — | Vikunja API token |
-| `PYPI_TOKEN` | — | Standard PyPI token (takes precedence over Gitea registry) |
-
-#### CI_GITEA_TOKEN scopes
-
-The `CI_GITEA_TOKEN` is a single Gitea Personal Access Token used across all
-workflows. It requires these scopes:
-
-| Scope | Purpose |
-|-------|---------|
-| `read:repository` | Read repos, PRs, issues, branches |
-| `write:repository` | Push commits, merge PRs, create tags/releases, create issues, set branch protection, push wiki |
-| `read:package` | Pull packages from Gitea PyPI registry, pull Docker images |
-| `write:package` | Publish packages to Gitea PyPI registry, push Docker images |
-| `read:organization` | Query org-level runners for molecule test distribution |
-
-### Per-project overrides
-
-Projects using devx can override the default API URLs and language by setting
-`DEVX_*` environment variables or entries in their `.env` file. Copy
-`.env.example` to `.env` and fill in your tokens:
-
-```bash
-cp .env.example .env
-```
-
-### Change classification
-
-Projects configure which file paths are infrastructure (no release needed) vs
-user-facing (release needed) in `pyproject.toml`:
-
-```toml
-[tool.devx.classify]
-# Merge with DEFAULT_INFRASTRUCTURE (CI workflows, tests, docs, config)
-# use_defaults = true   # (default)
-
-# Project-specific infrastructure paths (merged with defaults)
-infrastructure = []
-
-# Files that would default to user-facing but are actually infrastructure
-infrastructure_overrides = [
-    "src/myproject/__init__.py",  # example only — only contains __version__
-]
-
-# Safety override for broad infrastructure patterns
-user_facing_overrides = []
-
-# Tag patterns for CI conditional execution (orthogonal to release impact)
-[tool.devx.classify.tags]
-# ansible = ["ansible/**"]
-```
-
-## Development
-
-```bash
-git clone https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git
-cd devx
-make setup         # Create venv, install deps, hooks, CI tools
-make lint-all      # ruff + pyright + bandit + actionlint
-make pytest-cov    # Unit tests with 100% coverage
-make test-unit     # Unit tests without coverage
-make workflow-check  # Static + dry-run validation of workflow YAML
-make clean         # Remove caches, build artifacts, coverage data
-```
-
-`make setup` automatically installs all development tools:
- **Python deps** via `python -m devx.tools.setup` (pip install -e .[dev], pre-commit hooks)
- **actionlint, git-cliff, act_runner, tea** via `python -m devx.tools.install_tools`
- **tea CLI login** via `python -m devx.tools.setup` (configures `tea login` from `.env`)
-
-### Make targets
-
-| Target | Description |
-|--------|-------------|
-| `make setup` | Full local development setup (venv, deps, hooks, CI tools) |
-| `make setup-ci` | Lean setup for CI jobs (pytest + lint + runtime deps) |
-| `make setup-quality` | Setup for quality job (lint + test deps, actionlint) |
-| `make setup-release` | Setup for release jobs (git-cliff, tea, lint tools) |
-| `make install-tools` | Install actionlint, git-cliff, act_runner, tea |
-| `make install-hooks` | Install git hooks (pre-commit, pre-push) |
-| `make lint` | ruff check + ruff format check + pyright + bandit |
-| `make lint-ruff` | ruff check only |
-| `make lint-format` | ruff format check only |
-| `make typecheck` | pyright only |
-| `make lint-bandit` | bandit security scan only |
-| `make lint-all` | lint + workflow-lint (actionlint) |
-| `make lint-deps` | pip-audit dependency vulnerability scan |
-| `make test-unit` | Unit tests without coverage |
-| `make pytest-cov` | Unit tests with 100% coverage enforcement |
-| `make workflow-lint` | actionlint on `.gitea/workflows/*.yml` |
-| `make workflow-dryrun` | act_runner exec --dryrun on all workflows |
-| `make workflow-check` | workflow-lint + workflow-dryrun |
-| `make clean` | Remove caches, build artifacts, coverage data |
-
-See [AGENTS.md](AGENTS.md) for full project conventions, PR workflow, and
-architecture details.
-
-## Architecture overview
-
-devx is a self-contained Python package under `src/devx/`. It never imports
-from scripts outside the package. All tools are invoked via
-`python -m devx.ci.*`, `python -m devx.tools.*`, or `python -m devx.molecule.*`.
-
-```text
-src/devx/
-├── __init__.py          # Version (single source of truth, read by setuptools)
-├── cli.py               # Click-based CLI entry point (devx command)
-├── config.py            # Configuration system (DEVX_ env vars, .env loading)
-├── api_clients.py       # GiteaClient, VikunjaClient — HTTP API wrappers
-├── gitea_cli.py         # TeaCLI — wrapper around tea CLI with JSON parsing
-├── i18n.py              # Translation system (gettext-based, translations.json)
-├── exceptions.py        # Custom exception types (DevxError, APIError)
-├── opentofu.py          # OpenTofu output helpers
-├── translations.json    # Translation strings (en, bg, de, ru, zh, pl)
-├── ci/                  # CI/CD automation modules (run by workflows)
-├── tools/               # Developer tooling modules (run locally or by CI)
-└── molecule/            # Optional molecule testing helpers (for Ansible projects)
-```
-
-### Design principles
-
- **Self-contained package** — `src/devx/` never imports from scripts outside the package
- **Module-based invocation** — All tools invoked via `python -m devx.ci.*` or `python -m devx.tools.*`
- **PYTHONPATH: src** — Workflows set `PYTHONPATH: src` (not `.:src` since there are no scripts at repo root)
- **Config via env vars** — `DEVX_*` environment variables with `.env` file fallback
- **100% test coverage** — enforced by `--cov-fail-under=100`
- **i18n by default** — all user-facing strings wrapped in `_()` for translation
-
-See [Architecture](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/Architecture)
-and [CI/CD Workflow](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/CI-CD-Workflow)
-in the wiki for detailed documentation.
-
-## Links
-
- **Wiki**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
- **Releases**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
- **Actions**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
- **Source**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx](https://git.oblachno.oblachno.fyi/oblachno-oss/devx)
- **GRM (origin project)**: [https://git.oblachno.oblachno.fyi/oblachno-oss/grm](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
-
-## License
-
-GPL-3.0 — see [LICENSE](LICENSE).
@@ -1,3 +0,0 @@
-#!/usr/bin/env fish
-set -l script_dir (dirname (status --current-filename))
-source "$script_dir/.venv/bin/activate.fish"
@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/.venv/bin/activate"
@@ -1,4 +0,0 @@
-#!/usr/bin/env zsh
-0="${ZERO:-${0:#$ZSH_ARGZERO}}"
-0="${${(M)0:#/*}:-$PWD/$0}"
-source "${0:A:h}/.venv/bin/activate"
@@ -1,71 +0,0 @@
-# git-cliff configuration for devx
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-header = """
-# Changelog\n
-All notable changes to this project will be documented in this file.\n
-"""
-body = """
-{% if version %}\
-    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
-{% else %}\
-    ## [unreleased]
-{% endif %}\
-{% for group, commits in commits | group_by(attribute="group") %}
-    ### {{ group | striptags | trim | upper_first }}
-    {% for commit in commits %}
-        - {% if commit.scope %}*({{ commit.scope }})* {% endif %}\
-            {% if commit.breaking %}[**breaking**] {% endif %}\
-            {{ commit.message | upper_first }}\
-    {% endfor %}
-{% endfor %}
-"""
-trim = true
-render_always = true
-
-[git]
-conventional_commits = true
-filter_unconventional = true
-require_conventional = false
-split_commits = false
-protect_breaking_commits = false
-filter_commits = false
-fail_on_unmatched_commit = false
-use_branch_tags = false
-topo_order = false
-topo_order_commits = true
-sort_commits = "oldest"
-recurse_submodules = false
-
-commit_preprocessors = [
-    # Strip DEVX-N: task ID prefix from squash-merge commits so git-cliff sees conventional commits
-    { pattern = "^DEVX-\\d+:\\s+", replace = "" },
-]
-
-commit_parsers = [
-    { message = "^feat", group = "<!-- 0 -->Features" },
-    { message = "^fix", group = "<!-- 1 -->Bug Fixes" },
-    { message = "^perf", group = "<!-- 4 -->Performance" },
-    { message = "^refactor", group = "<!-- 2 -->Refactor" },
-    # Skip infrastructure-only commits — they don't affect users
-    { message = "^doc", skip = true },
-    { message = "^test", skip = true },
-    { message = "^style", skip = true },
-    { message = "^chore", skip = true },
-    { message = "^ci", skip = true },
-    # Skip release commits — they are release artifacts, not features
-    { message = "^release:", skip = true },
-    { body = ".*security", group = "<!-- 8 -->Security" },
-    { message = "^revert", group = "<!-- 9 -->Revert" },
-    # Skip anything that doesn't match above — safe default
-    { message = ".*", skip = true },
-]
-
-[bump]
-features_always_bump_minor = true
-breaking_always_bump_major = false
-initial_tag = "0.1.0"
-# Refactor commits bump patch — structural changes to src/ or pyproject.toml
-# affect users even though no new feature was added.
-refactor_always_bump_patch = true
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="104" height="20" role="img"
+  aria-label="coverage: 100%">
+  <title>coverage: 100%</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="104" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="66" height="20" fill="#555"/>
+    <rect x="66" width="38" height="20" fill="#4c1"/>
+    <rect width="104" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="33" y="14">coverage</text>
+    <text x="85" y="14">100%</text>
+  </g>
+</svg>
@@ -1,26 +0,0 @@
-# ci-base — lightweight image for CI jobs that only need devx core + tea.
-#
-# Used by: detect-type, detect-changes, validate-commit-msg, pr-review,
-#          auto-merge, sync-wiki, vikunja, configure-repo, discover-runners,
-#          molecule-report, discover-integration-runners
-#
-# Jobs using this image: setup is instant (ln -s /opt/venv .venv)
-# No pip install needed — devx and all deps are pre-installed.
-
-FROM gitea/runner-images:ubuntu-latest
-
-# Create a virtual environment with all deps pre-installed
-RUN python3 -m venv /opt/venv
-ENV PATH="/opt/venv/bin:/root/.local/bin:$PATH"
-
-# Install devx from local source (build context = devx repo root)
-COPY . /tmp/devx
-RUN pip install --no-cache-dir --upgrade pip setuptools wheel \
-    && pip install --no-cache-dir /tmp/devx[ci] \
-    && rm -rf /tmp/devx
-
-# Install tea CLI (for Gitea API operations in CI)
-RUN python3 -m devx.tools.install_tools --tool tea
-
-# Workspace directory (actions/checkout mounts repo here)
-WORKDIR /workspace
@@ -1,25 +0,0 @@
-# ci-full — heaviest image, includes everything for release, molecule, deploy.
-#
-# Used by: release, publish, release-dry-run, molecule-tests,
-#          provision-infra, deploy-observability, provision-zitadel,
-#          deploy-customer, integration-tests
-#
-# Layers on top of ci-quality: adds release tools, molecule, deploy deps,
-# git-cliff, and OpenTofu.
-
-FROM git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-quality:latest
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-# Install rsync (required by molecule_docker for file sync between host and test containers)
-RUN apt-get update && apt-get install -y --no-install-recommends rsync \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install devx[release,molecule,deploy] from local source
-COPY . /tmp/devx
-RUN pip install --no-cache-dir /tmp/devx[release,molecule,deploy] \
-    && rm -rf /tmp/devx
-
-# Install git-cliff (changelog generator for release job), OpenTofu (for infra deploy jobs),
-# and promtool (Prometheus rule validator — used by every infra CI run for alert validation)
-RUN python3 -m devx.tools.install_tools --tool git-cliff --tool tofu --tool promtool
@@ -1,17 +0,0 @@
-# ci-quality — image for lint, type-checking, badge generation.
-#
-# Used by: quality (lint-all + pytest-cov + checks), badges (generate_badges
-#          runs ruff/pyright/bandit to produce quality badge)
-#
-# Layers on top of ci-base: adds lint tools + actionlint + checkmake.
-
-FROM git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
-
-# Install devx[lint] from local source (adds ruff, pyright, bandit, etc.)
-COPY . /tmp/devx
-RUN pip install --no-cache-dir /tmp/devx[lint] \
-    && rm -rf /tmp/devx
-
-# Install CI/CD binary tools
-RUN python3 -m devx.tools.install_tools --tool actionlint --tool vale --tool hadolint \
-    && python3 -m devx.tools.install_checkmake
@@ -1,20 +0,0 @@
-[
-  {
-    "name": "oblachno-oss/runner-images/ci-base",
-    "dockerfile": "docker/ci-base/Dockerfile",
-    "context": ".",
-    "tags": ["latest"]
-  },
-  {
-    "name": "oblachno-oss/runner-images/ci-quality",
-    "dockerfile": "docker/ci-quality/Dockerfile",
-    "context": ".",
-    "tags": ["latest"]
-  },
-  {
-    "name": "oblachno-oss/runner-images/ci-full",
-    "dockerfile": "docker/ci-full/Dockerfile",
-    "context": ".",
-    "tags": ["latest"]
-  }
-]
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="76" height="20" role="img"
+  aria-label="docs: 100%">
+  <title>docs: 100%</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="76" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="38" height="20" fill="#555"/>
+    <rect x="38" width="38" height="20" fill="#4c1"/>
+    <rect width="76" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="19" y="14">docs</text>
+    <text x="57" y="14">100%</text>
+  </g>
+</svg>
@@ -1,173 +0,0 @@
-# ADR-0001: Test Isolation Pytest Plugin and Shift-Left Quality Gates
-
-Date: 2026-07-13
-Status: Accepted
-
-## Context
-
-Unit tests in devx were slow (10s+) and getting slower. Investigation
-revealed two root causes:
-
-1. **Unpatched subprocess calls** — test functions calling
-   `subprocess.run`, `update_doc_versions`, or `run_cmd` without
-   `@patch` decorators, causing real subprocess execution during tests.
-2. **Excessive iterations** — statistical tests with 1000-iteration
-   loops that should use property-based testing or smaller samples.
-
-These issues were discovered manually by profiling with
-`pytest --durations=0`. There was no automated check to prevent
-regressions — new tests could introduce the same patterns and slow
-down the suite again.
-
-Additionally, translation completeness checks
-(`devx.ci.check_translations`) only ran in CI, not locally. Developers
-discovered missing translations at CI time, wasting round-trips.
-
-## Decision
-
-### 1. Test Isolation as a Pytest Plugin (pytest11 entry point)
-
-Implement the test isolation check as a **pytest plugin** registered
-via the `pytest11` entry point in `pyproject.toml`:
-
-```toml
-[project.entry-points.pytest11]
-devx_test_isolation = "devx.tools.check_test_isolation"
-```
-
-This makes the check **transparent and always-on** — every `pytest`
-invocation in any repo with devx installed automatically runs the
-static analysis. No extra Makefile target or CI step needed.
-
-The plugin (`devx.tools.check_test_isolation`) statically analyzes
-test files during `pytest_collection_finish` and **fails the test run**
-on any hard violation:
-
- **unpatched-subprocess**: `subprocess.run/call/Popen/check_call/check_output`
-  called in a test function without `@patch` or `with patch(...)`
- **unpatched-sleep**: `time.sleep` called without `@patch`
- **unpatched-helper**: known subprocess-spawning helpers
-  (`update_doc_versions`, `run_cmd`, `run_tests`) called without
-  `@patch` (and without patching their internal dependencies)
- **excessive-iterations**: `for _ in range(N)` where N > 100
- **heavy-module-import**: `httpx`, `ansible`, etc. imported at module
-  level in test files, slowing collection for all tests
- **reload-without-cleanup**: `importlib.reload()` called an odd number
-  of times, leaving module state modified
-
-Transitive-subprocess findings (via call-graph analysis) are reported
-as **advisories** — the static analysis can't predict early exits or
-runtime branch conditions, so the runtime audit is authoritative.
-
-The plugin also wraps `subprocess.run` at runtime to catch real
-subprocess calls that leak through transitive call paths (for example
-`CliRunner.invoke(main)` → `main()` → `update_doc_versions()` →
-`subprocess.run()`). If a test spawns a real subprocess without
-`@patch`, the test fails.
-
-A standalone CLI (`python -m devx.tools.check_test_isolation`) is also
-provided for CI gates and pre-commit hooks where pytest isn't run.
-
-### 2. Shift-Left Quality Gates in `make lint`
-
-Add `devx-check-translations` and `devx-check-test-isolation` to the
-`devx-lint` target in `devx.mak`. This means `make lint` now runs:
-
- ruff check + format
- pyright typecheck
- bandit security scan
- **translation completeness** (missing keys, dead keys, missing languages)
- **test isolation** (unpatched subprocess, time.sleep, excessive loops)
-
-These were previously CI-only checks. Running them in `make lint`
-catches issues at the developer's machine, not in CI.
-
-### 3. Pre-commit Hook Coverage
-
-Update the pre-commit hook to run all three shift-left checks:
-test speed, translation completeness, and test isolation. This
-catches issues even earlier than `make lint` — before the commit
-is even created.
-
-## Consequences
-
-### Positive
-
- **Automatic enforcement**: The pytest plugin runs on every `pytest`
-  invocation across devx, grm, and infra — no per-repo configuration
-  needed. New tests with unpatched subprocess calls fail immediately.
- **Shift-left**: Translation gaps and test isolation violations are
-  caught locally (pre-commit / `make lint`) instead of in CI.
- **Fast feedback**: Static analysis adds <0.1s to test runs; runtime
-  subprocess audit adds negligible overhead (wrapper checks a
-  thread-local flag).
- **Transitive detection**: The call-graph BFS traces
-  `CliRunner.invoke(main)` → `main()` → `update_doc_versions()` →
-  `subprocess.run()`, catching indirect subprocess leaks that direct
-  analysis misses. The runtime audit provides authoritative enforcement.
- **No false positives**: The call graph correctly recognizes that
-  patching `run_cmd` makes `run_tests` (which calls `run_cmd`) safe,
-  and class methods are excluded to avoid false positives when classes
-  like `TeaCLI` are patched.
-
-### Negative
-
- **Coverage instrumentation gap**: The pytest plugin module is loaded
-  before coverage starts, so module-level code (decorators, class
-  definitions) appears uncovered. Mitigated by `-p no:devx_test_isolation`
-  in devx's own `pyproject.toml` `addopts` and `# pragma: no cover` on
-  plugin hook functions.
- **Static analysis limitations**: The call-graph BFS can't predict
-  runtime branch conditions or early exits — a test that patches
-  `shutil.which` to return `None` may skip the subprocess path
-  entirely, but the static analysis still reports it. Transitive
-  findings are advisories (exit 0) for this reason; the runtime audit
-  is authoritative.
- **Translation burden**: Every new `_()` call in source requires
-  adding 6 language translations. This is by design (all supported
-  languages must be complete) but adds friction for quick prototypes.
-
-## Implementation Details
-
-### Pytest Plugin Discovery
-
-The `pytest11` entry point is the standard mechanism for pytest
-plugins. When devx is installed (via pip), pytest auto-discovers
-the plugin. No `conftest.py` or `pytest_plugins` declaration needed
-in consumer repos.
-
-### Disabling the Plugin
-
- `--no-test-isolation` flag: disables static analysis and runtime
-  subprocess audit for a single run
- `-p no:devx_test_isolation` in `addopts`: disables for a repo
-  (used in devx's own `pyproject.toml` for coverage reasons)
-
-### Call-Graph Analysis
-
-The `CallGraph` class parses all `.py` files under `src/` and builds
-a map of function → called functions. When a test calls
-`CliRunner.invoke(target)`, a BFS traces the call graph from `target`
-to find all reachable functions. Class methods are excluded from the
-call graph to avoid false positives when classes are patched (for example
-`@patch("...TeaCLI")` mocks all methods). The BFS respects `@patch`
-decorators — if a function is patched, traversal stops at that node.
-
-### Runtime Subprocess Audit
-
-The `_SubprocessAudit` singleton wraps `subprocess.run`, `call`,
-`check_call`, `check_output`, and `Popen` with thread-local
-recording wrappers. During each non-integration test, the wrapper
-records calls; if any are recorded (that is the test didn't `@patch`
-subprocess), the test fails. The wrappers check a thread-local flag,
-so inactive audits have zero overhead beyond the flag check.
-
-### Known Subprocess Helpers
-
-The `KNOWN_SUBPROCESS_HELPERS` dict maps function names to
-descriptions. `HELPER_INTERNAL_CALLS` maps each helper to the
-function names it internally calls, enabling transitive safety
-checks for direct calls in test functions. The call-graph BFS
-handles transitive detection for `CliRunner.invoke` targets. Both
-are defined in `check_test_isolation.py` and can be extended as
-new subprocess-spawning helpers are added to devx.
@@ -1,175 +0,0 @@
-# devx — Reusable Development & CI/CD Tools
-
-A Python package providing reusable development and CI/CD automation tools for
-oblachno-oss projects. devx consolidates release management, PR automation,
-wiki sync, badge generation, translation checks, documentation coverage,
-parallel test distribution, and more into a single installable package.
-
-It was extracted from the [GRM](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
-project to be reusable across all oblachno-oss repositories.
-
-> An open-source project from **Oblachno** (облачно means *cloudy* in Bulgarian).
-
-[![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b91ca06bc570610a24437fd248126ce1a245a798/python.svg)](https://www.python.org/downloads/)
-
-## Overview
-
-devx provides a complete, opinionated CI/CD pipeline for any project hosted on
-a Gitea instance with Gitea Actions. Install the package, declare configuration
-via environment variables and `pyproject.toml`, and inherit:
-
- **Automated releases** — git-cliff-driven semver versioning, changelog
-  generation, tagging, and publishing to a Gitea PyPI registry.
- **PR automation** — squash-merge with task ID validation, automated PR
-  review with inline comments, and conventional commit enforcement.
- **Smart change classification** — user-facing vs workflow-only change
-  detection so infrastructure-only changes skip releases.
- **Documentation sync** — push `docs/` markdown to the Gitea wiki with
-  integrity verification.
- **Quality badges** — self-contained SVG badges for coverage, tests, docs,
-  quality, version, and Python version.
- **Translation checks** — validate i18n keys against source code, detect
-  dead keys and missing languages.
- **Parallel test distribution** — split test files or molecule scenarios
-  across CI runners with cross-runner fail-fast.
- **Developer tools** — environment setup, CI tool installation, test speed
-  enforcement, repository configuration.
- **i18n** — built-in translations for English, Bulgarian, German, Russian,
-  Chinese, and Polish; projects can extend with their own keys.
-
-## Installation
-
-devx is published to the Gitea PyPI registry at
-`https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple`.
-The registry is publicly readable — no authentication required to install.
-
-### Quick install (one-off)
-
-```bash
-pip install devx --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
-```
-
-### Persistent configuration (recommended)
-
-Add the registry to `~/.pip/pip.conf`:
-
-```ini
-[global]
-extra-index-url = https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
-```
-
-Then `pip install devx` works without specifying `--index-url`.
-
-### As a dependency in another project
-
-Add devx to your `pyproject.toml` dependencies and configure the registry:
-
-```toml
-[project]
-dependencies = [
-    "devx>=0.48.1",
-]
-
-[tool.pip]
-extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
-```
-
-Pin a specific version if needed: `"devx==0.48.1"` or `"devx>=0.48.1,<0.49"`.
-
-### Optional extras
-
-```bash
-pip install "devx[ci,lint]"      # CI runners and linting (pytest, ruff, pyright, bandit, build, twine)
-pip install "devx[molecule]"     # Molecule testing for Ansible projects
-pip install "devx[dev]"          # Full local development (ci + lint + build + twine)
-```
-
-## Architecture
-
-devx is a self-contained Python package under `src/devx/`:
-
- **Core modules** — `config.py`, `exceptions.py`, `i18n.py`, `api_clients.py`,
-  `gitea_cli.py`, `cli.py`, `opentofu.py`
- **CI automation** (`devx.ci`) — release, publish, auto_merge, pr_review,
-  classify_changes, sync_wiki, push_badges, check_translations, doc_coverage,
-  validate_commit_msg, detect_release_commit, notify_failure, post_merge,
-  discover_runners, distribute_files, integration_guard
- **Dev tools** (`devx.tools`) — setup, install_tools, check_test_speed,
-  configure_repo, generate_badges, generate_cliff_config, install_checkmake
- **Molecule tools** (`devx.molecule`) — Optional, for projects with Ansible
-  roles: distribute_molecule, molecule_ci_guard, molecule_all, discover_runners,
-  start_docker, platforms
-
-See [Architecture](Architecture) for the full package structure, module
-descriptions, design principles, and data flow diagrams.
-
-## CI/CD pipeline
-
-devx uses Gitea Actions with three workflows:
-
- **CI** (`ci.yml`) — runs on pull requests: quality checks, change detection,
-  release dry-run, automated PR review, and auto-merge.
- **Post-merge** (`post-merge.yml`) — runs on every push to master: release
-  versioning, wiki sync, badge generation, Vikunja task updates, and repo
-  configuration.
- **Publish** (`publish.yml`) — runs on tag pushes: builds the package,
-  publishes to the Gitea PyPI registry, and creates a Gitea release.
-
-See [CI/CD Workflow](CI-CD-Workflow) for the full pipeline documentation,
-including the post-merge job graph, release process, badge generation, and
-wiki sync details.
-
-## CLI commands
-
-devx provides a `devx` CLI with three command groups:
-
- `devx ci <command>` — CI/CD automation (17 commands)
- `devx tools <command>` — Developer tools (9 commands)
- `devx molecule <command>` — Molecule testing (4 commands, optional)
-
-See [CLI Commands](CLI-Commands) for full command documentation with examples.
-
-## Configuration
-
-devx reads configuration from `DEVX_*` environment variables with `.env` file
-fallback. Key variables:
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `DEVX_GITEA_API_URL` | `https://git.oblachno.oblachno.fyi/api/v1` | Gitea API base URL |
-| `DEVX_VIKUNJA_API_URL` | `https://work.oblachno.oblachno.fyi/api/v1` | Vikunja API base URL |
-| `DEVX_REPO_OWNER` | **(must be set)** | Repository owner |
-| `DEVX_REPO_NAME` | **(must be set)** | Repository name |
-| `DEVX_TASK_PREFIX` | `DEVX` | Task ID prefix (GRM, OBL-INFRA, etc.) |
-| `DEVX_LANG` | `en` | Language for i18n (en, bg, de, ru, zh, pl) |
-| `CI_GITEA_TOKEN` | — | Gitea API token |
-| `VIKUNJA_TOKEN` | — | Vikunja API token |
-
-See [AGENTS.md](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/AGENTS.md)
-for the full configuration reference, PR workflow, and project conventions.
-
-## Wiki pages
-
- [Home](Home) — This page
- [Getting Started](Getting-Started) — Installation, configuration, and quick start guide
- [CLI Commands](CLI-Commands) — Full CLI command documentation with examples
- [Architecture](Architecture) — Package structure, module descriptions, design principles
- [CI/CD Workflow](CI-CD-Workflow) — Pipeline documentation, workflows, and CI scripts
-
-## Links
-
- **Source**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx](https://git.oblachno.oblachno.fyi/oblachno-oss/devx)
- **Releases**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
- **Actions**: [https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
- **GRM (origin project)**: [https://git.oblachno.oblachno.fyi/oblachno-oss/grm](https://git.oblachno.oblachno.fyi/oblachno-oss/grm)
-
-## License
-
-GPL-3.0
@@ -1,7 +0,0 @@
-{
-  "index.md": "Home",
-  "user/getting-started.md": "Getting-Started",
-  "user/cli-commands.md": "CLI-Commands",
-  "tech/architecture.md": "Architecture",
-  "tech/ci-cd-workflow.md": "CI-CD-Workflow"
-}
@@ -1,158 +0,0 @@
-# Retrospective: Self-Approval Fallback and CI Consolidation
-
-## Date
-2026-07-12
-
-## Context
-The devx package (reusable CI/CD tools) underwent two significant
-changes during this period: workflow consolidation (DEVX-126) and the
-self-approval fallback fix (DEVX-127). The self-approval bug was the
-last remaining blocker for end-to-end automated CI/CD across all
-oblachno repos. This retrospective covers devx v0.40.0 through v0.40.1.
-
-## Scope
-
-PRs: DEVX-125 (double-prefix detection), DEVX-126 (CI consolidation),
-DEVX-127 (self-approval fallback). ~16 commits including release/badge
-churn.
-
-## Timeline of Key Failures
-
-| Run   | Issue                                        | Fix Commit |
-|--------|----------------------------------------------|------------|
-| infra #2562 | Self-approval rejected (403)           | `d035b62` |
-| devx CI | Auto-merge review body too short (< 20 chars) | `fc613d4` |
-| devx CI | test_setup flaky due to PIP_BREAK_SYSTEM_PACKAGES | `043f259` |
-| devx CI | Missing translations for self-approval messages | `0d8c7f5` |
-
-## What Served Us Well
-
- **Test-driven fix for pr_review.py.** The self-approval fallback was
-  implemented with full test coverage before being deployed. Tests
-  covered both the fallback-available and fallback-unavailable paths,
-  ensuring the code was correct before it hit CI.
- **i18n enforcement caught missing translations.** The translation
-  completeness check flagged the new self-approval error messages that
-  were added without corresponding translation entries. This prevented
-  untranslated strings from reaching production.
- **Consolidated CI workflow.** DEVX-126 merged 7 separate CI jobs into
-  a single `validate` job, reducing runner overhead and eliminating
-  inter-job dependency issues. The consolidation pattern was then
-  applied to grm and infra.
- **Conventional commit enforcement.** The `validate_commit_msg` check
-  caught a double-prefix in the Vikunja task title (DEVX-125), which
-  would have caused auto-merge validation failures downstream.
-
-## What Slowed Us Down
-
-### 1. Self-Approval Bug Not Caught Earlier (1 infra CI failure)
-
-The `pr_review.py` script used the `REVIEWER_GITEA_API_TOKEN` for
-APPROVE events. When the token belonged to the PR author, Gitea
-rejected the self-approval with 403. This was only discovered when the
-infra PR CI run #2562 failed — the devx CI had passed because devx PRs
-were reviewed by a different user.
-
-**Root cause:** No test simulated the self-approval rejection scenario.
-The tests mocked the Gitea API to always return 200 for review
-submissions.
-
-**Time wasted:** ~2 hours (cross-repo investigation + fix + test).
-
-**Fix:** Added fallback to `CI_GITEA_API_TOKEN` when the reviewer token
-is rejected with self-approval. The fallback is transparent — the
-script logs a warning and retries with the CI token.
-
-**Lesson:** Test API interactions against all HTTP error codes the
-external system can return, not only the happy path. For Gitea, this
-includes 403 (self-approval), 409 (conflict), and 422 (validation).
-
-### 2. Auto-Merge Review Body Length Check (1 CI failure)
-
-The auto-merge validation requires APPROVE review bodies to be > 20
-chars (to prevent perfunctory approvals). The automated review posted
-by `pr_review.py` had a body of exactly 17 chars, failing the check.
-
-**Root cause:** The review body was a generic "Automated review passed"
-message that was too short. The length check was added to prevent
-rubber-stamping by human reviewers, but it also affected automated
-reviews.
-
-**Time wasted:** ~1 CI run.
-
-**Fix:** Expanded the automated review body to include a summary of
-checked categories, ensuring it exceeds 20 chars.
-
-**Lesson:** Automated reviews need substantive bodies too. The length
-check doesn't distinguish between human and automated reviewers.
-
-### 3. test_setup Flaky Due to Environment Variable (1 CI failure)
-
-`test_setup.py` failed intermittently because `PIP_BREAK_SYSTEM_PACKAGES`
-was set in the CI environment but not in local tests. The test didn't
-isolate itself from the environment variable.
-
-**Root cause:** The test assumed a clean environment but CI sets
-`PIP_BREAK_SYSTEM_PACKAGES=1` globally. The test's behavior changed
-based on this env var.
-
-**Time wasted:** ~1 CI run.
-
-**Fix:** Isolated the test from the env var using `monkeypatch.delenv`.
-
-**Lesson:** Tests that interact with environment-dependent behavior
-should explicitly set or unset the relevant env vars, not assume
-defaults.
-
-### 4. Missing Translations for New Messages (1 CI failure)
-
-The self-approval fallback added new user-facing messages (warning
-about token fallback) but didn't add translations for all supported
-languages. The translation completeness check caught this.
-
-**Root cause:** New `click.echo()` calls were added with `_()` wrappers
-but the translation JSON wasn't updated.
-
-**Time wasted:** ~1 CI run.
-
-**Fix:** Added translations for all new messages in `translations.json`.
-
-**Lesson:** When adding new `_()` wrapped strings, update
-`translations.json` in the same commit. The i18n check is strict —
-100% completeness is required.
-
-## Improvements Implemented
-
-### 1. Self-Approval Fallback (HIGH impact)
-
-`pr_review.py` now falls back to `CI_GITEA_API_TOKEN` for APPROVE
-events when the reviewer token is rejected as self-approval. This
-unblocked auto-merge across all three repos.
-
-### 2. Double-Prefix Detection (MEDIUM impact)
-
-`check_auto_merge_ready.py` now detects and rejects Vikunja task titles
-that include the identifier prefix (for example, "DEVX-127: Fix...").
-The validator adds the prefix automatically, so a double prefix would
-fail validation.
-
-### 3. CI Workflow Consolidation (MEDIUM impact)
-
-Merged 7 separate CI jobs into a single `validate` job, reducing runner
-overhead by ~5 min per CI run and eliminating inter-job dependency
-issues.
-
-## Action Items for Future Sessions
-
-1. **Test API interactions against all relevant HTTP error codes.**
-   Don't only test the happy path. For Gitea: 200, 201, 204, 403, 404,
-   409, 422.
-2. **Update translations in the same commit as new `_()` strings.**
-   The i18n check will fail otherwise.
-3. **Isolate tests from environment variables.** Use `monkeypatch.setenv`
-   or `monkeypatch.delenv` for any env var the test's behavior depends on.
-4. **Ensure automated review bodies are substantive (> 20 chars).**
-   Include a summary of checked categories.
-5. **When adding fallback logic, test both the fallback-available and
-   fallback-unavailable paths.** Both must be covered for 100% branch
-   coverage.
@@ -1,600 +0,0 @@
-# Architecture
-
-devx is a reusable Python package providing development and CI/CD tools for
-oblachno-oss projects. It is self-contained under `src/devx/` and never imports
-from scripts outside the package.
-
-## Package structure
-
-```text
-src/devx/
-├── __init__.py              # Version (single source of truth, read by setuptools)
-├── cli.py                   # Click-based CLI entry point (devx command)
-├── config.py                # Configuration system (DEVX_ env vars, .env loading)
-├── api_clients.py           # GiteaClient, VikunjaClient — HTTP API wrappers
-├── gitea_cli.py             # TeaCLI — wrapper around tea CLI with JSON parsing
-├── i18n.py                  # Translation system (JSON-based, translations.json)
-├── exceptions.py            # Custom exception types (DevxError, APIError)
-├── opentofu.py              # OpenTofu output helpers
-├── translations.json        # Translation strings (en, bg, de, ru, zh, pl)
-├── ci/                      # CI/CD automation modules (run by workflows)
-│   ├── __init__.py
-│   ├── _shared.py           # Shared utilities (get_latest_tag)
-│   ├── release.py           # Automated versioning, tagging, changelog
-│   ├── publish.py           # Build and publish to Gitea PyPI registry
-│   ├── auto_merge.py        # Squash-merge PRs with task ID validation
-│   ├── classify_changes.py  # User-facing vs workflow-only change detection
-│   ├── detect_release_commit.py  # Detect release commits on master
-│   ├── validate_commit_msg.py    # Conventional commit validation
-│   ├── pr_review.py         # Automated PR review
-│   ├── post_merge.py        # Vikunja task updates after merge
-│   ├── sync_wiki.py         # Sync documentation to Gitea wiki
-│   ├── push_badges.py       # Generate and push quality badges
-│   ├── notify_failure.py    # Create Gitea issues on CI failures
-│   ├── distribute_files.py  # Distribute files across parallel runners
-│   ├── integration_guard.py # Run pytest with cross-runner fail-fast
-│   ├── discover_runners.py  # Dynamic Gitea runner discovery
-│   ├── check_translations.py  # Translation completeness check
-│   └── doc_coverage.py      # Documentation coverage check
-├── tools/                   # Developer tooling modules (run locally or by CI)
-│   ├── __init__.py
-│   ├── setup.py             # Environment setup (venv, deps, hooks, tea login)
-│   ├── install_tools.py     # Install actionlint, git-cliff, act_runner, tea
-│   ├── check_test_speed.py  # Measure unit test execution time
-│   ├── check_test_isolation.py  # Pytest plugin: detect un-hermetic test patterns
-│   ├── configure_repo.py    # Branch protection and label setup
-│   ├── generate_badges.py   # Badge SVG generation
-│   ├── generate_cliff_config.py  # Generate cliff.toml with correct prefix
-│   └── install_checkmake.py # Install checkmake (Makefile linter)
-└── molecule/                # Optional molecule testing helpers (Ansible projects)
-    ├── __init__.py
-    ├── discover_runners.py      # Dynamic Gitea runner discovery
-    ├── distribute_molecule.py   # Distribute scenarios across runners
-    ├── molecule_ci_guard.py     # Run molecule with cross-runner fail-fast
-    ├── molecule_all.py          # Run all molecule scenarios locally
-    ├── start_docker.py          # Ensure Docker is available for molecule
-    └── platforms.py             # Supported molecule platforms
-```
-
-## Core modules
-
-### `__init__.py`
-
-Contains only `__version__`, the single source of truth for the package
-version. Read by setuptools via `dynamic = ["version"]` in `pyproject.toml`.
-Updated automatically by `devx.ci.release` during the release process. Treated
-as infrastructure (not user-facing) by the change classifier since it is a
-release artifact, not user code.
-
-### `cli.py`
-
-Click-based CLI entry point. Provides three command groups: `devx ci`,
-`devx tools`, and `devx molecule`. Each subcommand delegates to the
-corresponding module via `_run_module()`, which imports the module, sets
-`sys.argv`, and calls its `main()` function. This design keeps all logic in
-the modules themselves — `cli.py` is purely a router.
-
-The CLI is registered as a console script via `pyproject.toml`:
-```toml
-[project.scripts]
-devx = "devx.cli:cli"
-```
-
-### `config.py`
-
-Shared configuration constants for all devx modules. All defaults can be
-overridden via environment variables with the `DEVX_` prefix. Provides:
-
- `GITEA_API_URL` / `VIKUNJA_API_URL` — API endpoints
- `REPO_OWNER` — repository owner (must be set per-project)
- `TASK_PREFIX` / `TASK_ID_RE` — task ID prefix and regex (for example, `DEVX-N`)
- `VIKUNJA_PROJECT_ID` — Vikunja project for task tracking
- `DEFAULT_TIMEOUT`, `DEFAULT_PER_PAGE` — HTTP client defaults
- `MAX_RETRIES`, `RETRY_BACKOFF_BASE`, `RETRY_STATUS_CODES` — retry config
- `CONVENTIONAL_RE` — conventional commit format regex
-
-### `exceptions.py`
-
-Custom exception hierarchy:
-
- `DevxError` — base exception for all devx errors
- `APIError(DevxError)` — raised when a REST API call returns an HTTP error.
-  Carries `status` (HTTP status code) and `message` (error message).
-
-### `i18n.py`
-
-Simple i18n system using a JSON translations file (`translations.json`).
-Supports six languages: `en`, `bg`, `de`, `pl`, `ru`, `zh`. The `_()` function
-wraps user-facing strings for translation.
-
-Projects can extend translations by setting `DEVX_TRANSLATIONS_PATH` to a
-custom JSON file. Keys from the project's file are merged on top of devx's
-built-in translations, allowing projects to override or add keys without
-modifying the package.
-
-### `api_clients.py`
-
-Reusable HTTP API clients with connection pooling and retry logic. Both
-clients retry on transient errors (429, 5xx, connection errors) with
-exponential backoff (2s, 4s, 8s).
-
-**`GiteaClient`** — Gitea REST API wrapper:
- Branch protection (get, create, update)
- Labels (list, create, add to issues)
- Issues (create, list)
- Pull requests (get commits, merge, create review)
- Releases (list, create idempotent)
- Actions (list runs, list jobs, get job logs)
- Actions variables (get, set idempotent)
- Wiki pages (list, fetch, create, update, delete)
-
-**`VikunjaClient`** — Vikunja REST API wrapper:
- Tasks (list project tasks, get, update, mark done)
- Comments (create)
-
-### `gitea_cli.py`
-
-Thin Python wrapper around the `tea` Gitea CLI tool. Parses JSON output for
-structured data. Used by CI scripts for Gitea API operations that tea handles
-well, avoiding hand-rolled HTTP requests.
-
-**`TeaCLI`** operations:
- `create_issue()` — Create issues with labels
- `list_labels()` / `create_label()` / `add_label()` — Label management
- `create_pr()` / `merge_pr()` / `review_pr()` — Pull request operations
- `create_release()` / `list_releases()` — Release management
- `list_branches()` — Branch listing
-
-Operations NOT supported via tea (still use `GiteaClient`):
- Wiki page management
- Commit status checks
- Runner discovery
- PR file/commit listing (tea has limited support)
- Branch protection with detailed config
-
-### `opentofu.py`
-
-OpenTofu output helpers for CI/CD deployment scripts. Provides reusable
-functions for extracting values from `tofu output` in a structured way,
-eliminating duplicated `subprocess.run` boilerplate:
-
- `get_tofu_output(output_name, cwd, env)` — Run `tofu output -json` and return parsed JSON
- `get_tofu_vm_ip(output_name, vm_name, cwd, env)` — Extract a VM's IP address
- `get_tofu_vm_field(output_name, vm_name, field, cwd, env)` — Extract a VM field
-
-## CI/CD modules (`devx.ci`)
-
-Modules in this package are run by Gitea Actions workflows. They may import
-from `devx.api_clients`, `devx.config`, `devx.gitea_cli`, and `devx.i18n`.
-
-### `release.py`
-
-Automated release using git-cliff. Calculates the next semver version from
-conventional commits since the last tag, updates `__version__` in
-`__init__.py` and `CHANGELOG.md`, runs lint and tests to verify the release
-is healthy, commits with `release: vX.Y.Z [skip ci]`, creates an annotated
-tag, and pushes both to master.
-
-Idempotent: if there are no new conventional commits since the last tag, it
-exits without doing anything. If the tag already exists, it skips tag creation
-and only pushes. Includes a `--verify` mode that checks tag/version/changelog
-alignment without making changes.
-
-### `publish.py`
-
-Builds the Python package with `python -m build`, publishes to a Gitea PyPI
-registry (or standard PyPI if `PYPI_TOKEN` is set), and creates a Gitea
-release with git-cliff-generated notes. Supports `--skip-build` for non-Python
-repos that only need a Gitea release.
-
-### `auto_merge.py`
-
-Auto-merges a PR when all CI checks pass. Reads the task ID from the branch
-name, validates the PR title format against
-the Vikunja task title, extracts the conventional commit message from PR
-commits, and squash-merges with title `{PREFIX}-N <conventional commit>`.
-
-If the head branch is behind master (HTTP 405), it automatically pulls master,
-rebases, force-pushes, and retries the merge.
-
-### `classify_changes.py`
-
-Classifies git changes between two refs as user-facing or workflow-only. Uses
-a layered rule system configured in `pyproject.toml` under
-`[tool.devx.classify]`:
-
-1. **User-facing overrides** (highest priority — safety override)
-2. **Infrastructure overrides** (explicit per-file)
-3. **Infrastructure patterns** (DEFAULT_INFRASTRUCTURE + project-specific)
-4. **Default**: user-facing (safe default — any unknown file triggers release)
-
-Also supports custom tags (orthogonal to release impact) for CI conditional
-execution (for example, `ansible` tag to trigger molecule tests).
-
-### `pr_review.py`
-
-Automated PR review. Fetches the PR diff via the Gitea API and runs a series
-of checks, posting a structured review with `COMMENT` (no issues) or
-`REQUEST_CHANGES` (issues found):
-
- Architecture compliance (no subprocess in CLI, no hardcoded URLs)
- Best practices (no `print()`, no bare `except`, no `TODO`/`FIXME`, no
-  functions > 50 lines)
- Security (no hardcoded secrets, no `shell=True`, no `eval`/`exec`)
- i18n (no raw strings in `click.echo()` without `_()` wrapper)
- Resource management (no `open()` without `with`, no `Popen()` without cleanup)
- Documentation (source changes must include doc updates)
- Test coverage (source changes must include test updates)
- Commit conventions (conventional commit format on PR commits)
-
-### `sync_wiki.py`
-
-Syncs documentation from `docs/` to the Gitea wiki via the API. Reads
-`docs/mapping.json` to map file paths to wiki page titles, then creates or
-updates pages. Supports `--dry-run`, `--verify` (check content), and
-`--strict` (full integrity check: page count, missing pages, stale pages,
-content match).
-
-### `push_badges.py`
-
-Generates SVG badge files using `devx.tools.generate_badges`, pushes them to
-an orphan `badges` branch, and updates `README.md` and `docs/index.md` on
-master with cache-busting `raw/commit/<sha>/badge.svg` URLs (Gitea caches
-`raw/branch/` URLs for 6 hours). Fetches latest master before generating
-badges so the version badge reflects the current state. Supports `--retries`
-for retrying on git push failures.
-
-### `notify_failure.py`
-
-Creates a Gitea issue when a CI workflow fails. Uses the `tea` CLI for issue
-creation with failure labels. Supports `--auto-login` to configure the tea
-CLI login profile from `CI_GITEA_TOKEN` and `DEVX_GITEA_API_URL` before creating
-the issue.
-
-### `post_merge.py`
-
-Updates the Vikunja task after a merge to master. Extracts the task ID from
-the commit message, marks the task as done, and posts a comment with the
-merge SHA.
-
-### `validate_commit_msg.py`
-
-Validates commit messages. On feature branches: conventional commits only
-(no `{PREFIX}-N` prefix). On master: must have `{PREFIX}-N` prefix from
-auto-merge, followed by a conventional commit message.
-
-### `detect_release_commit.py`
-
-Detects whether the latest git commit is a release commit
-(`release: vX.Y.Z [skip ci]`). Writes `is-release=true` or `is-release=false`
-to `$GITHUB_OUTPUT` for use in CI workflow conditionals.
-
-### `check_translations.py`
-
-Validates translation files against the Python source code. Checks for
-missing keys (used in code but not in translations), dead keys (defined but
-not used), and missing languages (a key exists but is missing one of the five
-supported languages). Supports checking additional translation sets via
-`--translations`.
-
-### `doc_coverage.py`
-
-Checks documentation coverage for CLI commands and major modules. Parses
-Click commands from `cli.py` and verifies each has documentation in
-`docs/user/cli-commands.md`. Checks that core modules are documented in
-`architecture.md` and CI scripts in `ci-cd-workflow.md`. Supports
-`--fail-on-missing` to enforce 100% coverage.
-
-### `discover_runners.py`
-
-Discovers available Gitea Actions runners at three levels: repository,
-organization, and instance (admin). Falls back to the `MOLECULE_RUNNERS` repo
-variable or `DEFAULT_MAX_RUNNERS` (3). Outputs runner count or a JSON index
-array for use as a dynamic matrix in Gitea Actions.
-
-### `distribute_files.py`
-
-Distributes files matching a glob pattern across N parallel runners
-(round-robin). Writes the assigned file list for the current runner to
-`$GITHUB_ENV`. Used for splitting test suites across CI runners.
-
-### `integration_guard.py`
-
-Runs pytest with the same cross-runner failure detection mechanism used by
-`molecule_ci_guard`. If any other integration-tests matrix runner reports
-failure, the current pytest subprocess is killed and this runner exits early.
-
-## Developer tools (`devx.tools`)
-
-Modules in this package are run locally or by CI setup jobs. They may import
-from `devx.api_clients`, `devx.config`, and `devx.gitea_cli`.
-
-### `setup.py`
-
-Project setup: installs Python dependencies (editable mode with extras),
-Ansible Galaxy collections (if `ansible/requirements.yml` exists in the target repo), pre-commit
-hooks (pre-commit, commit-msg, pre-push), and configures the `tea` CLI login
-profile from `.env`. Supports `--extras` to specify dependency groups,
-`--no-pre-commit` to skip hook installation, and `--no-tea-login` to skip tea
-configuration.
-
-### `install_tools.py`
-
-Installs CI/CD development tools that are not Python packages: actionlint,
-git-cliff, act_runner, and tea. Each tool is installed to `~/.local/bin` if
-not already on PATH. Idempotent: skips tools that are already available.
-Supports `--tool` to install specific tools and `--list` to show status.
-
-### `check_test_speed.py`
-
-Runs unit tests and enforces execution-time budgets. Two quality gates:
-total suite time must not exceed `--max-seconds` (default: 10s), and no
-individual test may exceed `--max-single-seconds` (default: 0.5s, 0 to
-disable). Runs `make test-unit` with `PYTEST_ADDOPTS=--durations=0`.
-
-### `check_test_isolation.py`
-
-Pytest plugin (auto-discovered via `pytest11` entry point) that
-statically analyzes test files for un-hermetic patterns causing slow
-or flaky tests: unpatched `subprocess.run`/`time.sleep` calls, known
-subprocess-spawning helpers called without `@patch`, and excessive
-loop iterations (>100). Also available as a standalone CLI for CI
-gates and pre-commit hooks. See ADR-0001 for design rationale.
-
-### `configure_repo.py`
-
-Configures repository branch protection and labels via the Gitea REST API.
-Sets up master branch protection (required status checks, block on rejected
-reviews, block on outdated branch) and creates standard labels. Status check
-contexts are read from `DEVX_STATUS_CHECKS` or default to
-`CI / validate (pull_request)`.
-
-### `generate_badges.py`
-
-Generates self-contained SVG badge files from project metrics. Runs
-pytest-cov, doc-coverage, lint checks, and version extraction, then writes
-SVG files that can be served as static files from the Gitea raw file API.
-Badges generated: coverage, tests, docs, quality, version, python.
-
-### `generate_cliff_config.py`
-
-Generates a `cliff.toml` configuration file with the correct task ID prefix
-preprocessor. Eliminates the need to manually duplicate and maintain
-`cliff.toml` across repos that use devx. Supports `--prefix` to set the task
-ID prefix and `--force` to overwrite an existing file.
-
-### `install_checkmake.py`
-
-Installs checkmake (Makefile linter) if not already present. Tries
-`go install` first if Go is available, otherwise downloads the latest
-pre-built Linux binary from the official GitHub releases.
-
-## Molecule modules (`devx.molecule`)
-
-Optional modules for projects with Ansible roles. Requires the `molecule`
-extra (`pip install devx[molecule]`).
-
-### `distribute_molecule.py`
-
-Distributes molecule (scenario, platform) pairs across N parallel runners.
-Discovers scenarios under `ansible/roles/*/molecule/` and crosses them with
-the supported OS platform matrix. Supports `--roles-root` for multi-role
-repositories, `--list` to list scenarios, and `--list-platforms` to list
-platforms.
-
-### `molecule_ci_guard.py`
-
-Runs molecule tests sequentially while polling the Gitea API for other runner
-failures. If any other molecule matrix runner reports failure, the current
-molecule subprocess is killed and this runner exits early. Supports both
-single-role (4-part) and multi-role (5-part) pair encoding.
-
-### `molecule_all.py`
-
-Runs all molecule scenarios on all supported OS platforms sequentially.
-Intended for local development; CI uses the parallel matrix instead.
-
-### `molecule/discover_runners.py`
-
-Discovers available Gitea Actions runners for molecule tests. Same logic as
-`devx.ci.discover_runners` but intended for molecule-specific workflows.
-
-### `start_docker.py`
-
-Ensures Docker is available for molecule tests in CI. Verifies Docker is
-accessible and sets `DOCKER_HOST` explicitly. If the host socket is not
-available, tries the rootless socket, then starts a local `dockerd` with the
-vfs storage driver (requires privileged container).
-
-### `platforms.py`
-
-Single source of truth for the supported OS platform matrix. Each entry maps
-a short name to (image, command). Uses the project's pre-built
-molecule-test-base image with `sleep infinity` (not systemd) to avoid cgroup
-v2 failures. Supports loading custom platforms from a JSON file.
-
-## Design principles
-
- **Self-contained package** — `src/devx/` never imports from scripts outside
-  the package. This allows devx to be installed and used as a dependency
-  without requiring a specific repo layout in the consumer.
- **Module-based invocation** — All tools invoked via `python -m devx.ci.*`,
-  `python -m devx.tools.*`, or `python -m devx.molecule.*`. The `devx` CLI is
-  a thin router that delegates to module `main()` functions.
- **PYTHONPATH: src** — Workflows set `PYTHONPATH: src` (not `.:src` since
-  there are no scripts at repo root). The `src` directory is the sole import
-  root.
- **Config via env vars** — `DEVX_*` environment variables with `.env` file
-  fallback. Projects override defaults via environment or `.env`, never by
-  editing package code.
- **100% test coverage** — enforced by `--cov-fail-under=100` in pytest.
- **i18n by default** — all user-facing strings wrapped in `_()` for
-  translation. Five languages supported out of the box.
- **Safe-by-default classification** — any file that doesn't match an
-  infrastructure pattern defaults to user-facing, triggering a release. This
-  prevents new file types from accidentally skipping releases.
- **Secrets via environment** — secrets are passed via environment variables,
-  never on the command line.
-
-## Import rules
-
-1. **`src/devx/` is self-contained** — the package never imports from outside `src/`
-2. **CI modules** (`devx.ci.*`) may import from `devx.api_clients`,
-   `devx.config`, `devx.gitea_cli`, `devx.i18n`
-3. **Tool modules** (`devx.tools.*`) may import from `devx.api_clients`,
-   `devx.config`, `devx.gitea_cli`
-4. **Cross-module imports** within `devx.ci.*` or `devx.tools.*` are allowed
-   but must be documented (for example, `release.py` imports from
-   `classify_changes.py`)
-
-## Data flow
-
-### PR lifecycle
-
-```text
-Developer creates Vikunja task (DEVX-N)
-    │
-    ▼
-Developer creates branch (DEVX-N-short-description)
-    │
-    ▼
-Developer commits (conventional commits, no DEVX-N prefix)
-    │
-    ▼
-Developer pushes and creates PR (title: "DEVX-N: <vikunja task title>")
-    │
-    ▼
-CI workflow (ci.yml) triggers:
-    │
-    ├── validate (single job: quality + detect-changes +
-    │            release-dry-run + pr-review + pre-merge validation)
-    │       ├── quality steps (lint, tests, coverage, test speed, doc coverage,
-    │       │                 translation check, dependency scan, workflow dry-run)
-    │       ├── detect-changes (classify_changes.py → user-facing or workflow-only)
-    │       │       └── if user-facing → release-dry-run (release.py --dry-run)
-    │       ├── pre-merge validation (check_auto_merge_ready.py)
-    │       └── pr-review (pr_review.py → posts COMMENT or REQUEST_CHANGES)
-    │
-    └── auto-merge (auto_merge.py)
-            ├── validate PR title format
-            ├── validate PR title matches Vikunja task title
-            ├── extract conventional commit message from PR commits
-            ├── squash-merge with "DEVX-N <conventional commit>" title
-            └── push to master
-                    │
-                    ▼
-            Post-merge workflow triggers (see below)
-```
-
-### Post-merge flow
-
-```text
-Push to master (squash-merge commit: "DEVX-N <conventional commit>")
-    │
-    ▼
-Post-merge workflow (post-merge.yml) triggers:
-    │
-    ├── detect-and-configure (single job)
-    │       ├── configure-repo (configure_repo.py)
-    │       ├── detect-type (detect_release_commit.py)
-    │       │       └── is-release? → skip all steps except badges
-    │       └── validate-commit-msg (validate_commit_msg.py --branch master)
-    │
-    └── release-and-maintain (needs detect-and-configure)
-            ├── release (release.py) [skip if release commit or workflow-only]
-            │       ├── classify_changes.py → skip if workflow-only
-            │       ├── git-cliff → calculate next version
-            │       ├── update __version__ in __init__.py
-            │       ├── update CHANGELOG.md
-            │       ├── run make lint-ruff && make pytest-cov
-            │       ├── commit "release: vX.Y.Z [skip ci]"
-            │       ├── create annotated tag vX.Y.Z
-            │       └── push commit + tag to master
-            │               │
-            │               ▼
-            │       publish (publish.py) [if release created a tag]
-            │               ├── build package (python -m build)
-            │               ├── publish to Gitea PyPI registry (twine upload)
-            │               │   OR publish to standard PyPI (if PYPI_TOKEN set)
-            │               │   OR skip publish (if --skip-build)
-            │               └── create Gitea release with git-cliff notes
-            │
-            ├── sync-wiki (sync_wiki.py --strict) [skip if automated]
-            │       └── sync docs/ to Gitea wiki with integrity check
-            │
-            ├── vikunja (post_merge.py) [skip if automated]
-            │       ├── extract task ID from commit message
-            │       ├── mark Vikunja task as done
-            │       └── post comment with merge SHA
-            │
-            └── badges (push_badges.py) [ALWAYS runs, even on release commits]
-                    ├── fetch latest master
-                    ├── generate_badges.py → SVG files
-                    ├── push to orphan badges branch
-                    └── update README.md + docs/index.md with cache-busting URLs
-```
-
-### Publish flow
-
-```text
-Within release-and-maintain job (after release step creates a tag):
-    │
-    ├── install build, twine, git-cliff, tea
-    ├── configure tea login
-    ├── checkout release tag
-    │
-    └── publish (publish.py)
-            ├── build package (python -m build)
-            ├── publish to Gitea PyPI registry (twine upload)
-            │   OR publish to standard PyPI (if PYPI_TOKEN set)
-            │   OR skip publish (if --skip-build)
-            └── create Gitea release with git-cliff notes
-```
-
-### Badge generation flow
-
-```text
-push_badges.py:
-    │
-    ├── fetch_latest_master() → git fetch + reset --hard origin/master
-    │
-    ├── generate_badges() → devx.tools.generate_badges
-    │       ├── run pytest-cov → parse coverage %
-    │       ├── run pytest → parse test count
-    │       ├── run doc_coverage → parse doc coverage %
-    │       ├── run lint → quality status
-    │       ├── read __version__ from __init__.py
-    │       └── write SVG files to .badges/
-    │
-    ├── push_to_badges_branch()
-    │       ├── git checkout --orphan badges
-    │       ├── git rm -rf .
-    │       ├── copy SVG files to root
-    │       ├── git commit "Update badges [skip ci]"
-    │       ├── git push origin badges --force
-    │       └── return commit SHA
-    │
-    └── update_readme_with_badge_sha()
-            ├── git checkout master
-            ├── replace raw/branch/badges/ URLs with raw/commit/<sha>/ URLs
-            ├── git commit "chore: update badge URLs [skip ci]"
-            └── git push origin master
-```
-
-## tea CLI integration
-
-The `tea` Gitea CLI tool is used for Gitea API interactions where tea provides
-reliable, official support. It is installed by
-`python -m devx.tools.install_tools` and configured by
-`python -m devx.tools.setup` (login profile from `.env` `CI_GITEA_TOKEN`).
-
-`devx.gitea_cli.TeaCLI` wraps tea with JSON output parsing. Operations that
-tea does not support (wiki management, commit status, runner discovery,
-detailed branch protection) fall back to `GiteaClient` (direct HTTP).
-
-## Version source
-
-The version source is `__version__` in `src/devx/__init__.py`, read by
-setuptools via `dynamic = ["version"]` in `pyproject.toml`. The release
-script updates this file, commits it, and tags the commit. This ensures the
-package version, git tag, and changelog always stay aligned.
@@ -1,581 +0,0 @@
-# CI/CD Workflow
-
-devx uses Gitea Actions for CI/CD automation. Two workflows implement a
-complete pipeline: pull request validation and post-merge release
-automation (including publishing).
-
-## Workflow overview
-
-```text
-PR opened/synchronized ──► CI (ci.yml)
-    │                         ├── validate (quality + detect-changes +
-    │                         │              release-dry-run + pr-review +
-    │                         │              pre-merge validation)
-    │                         └── auto-merge ──► squash-merge to master
-    │                                              │
-    ▼                                              ▼
-Push to master ──► Post-merge (post-merge.yml)
-                     ├── detect-and-configure (detect-type +
-                     │                          validate-commit-msg +
-                     │                          configure-repo)
-                     └── release-and-maintain
-                          ├── release ──► tag vX.Y.Z
-                          ├── publish ──► Gitea PyPI registry + Gitea release
-                          ├── sync-wiki
-                          ├── vikunja
-                          └── badges (always runs)
-```
-
-## CI workflow (`ci.yml`)
-
-Runs on pull requests (opened and synchronize) and manual dispatch.
-
-### Jobs
-
-#### `validate`
-
-The single validation job. Consolidates the former `quality`,
-`detect-changes`, `release-dry-run`, `pr-review`, and `pre-merge-check`
-jobs into one job to save checkout+setup overhead. Runs on every PR.
-
-**Quality steps**
-
-The main quality gate:
-
-1. **Lint all** — ruff check, ruff format check, pyright, bandit, actionlint
-   (via `make lint-all`)
-2. **Unit tests with 100% coverage** — `make pytest-cov`
-3. **Check unit test speed** — `python -m devx.tools.check_test_speed
-   --max-seconds 4 --max-single-seconds 0.5`
-4. **Documentation coverage check** — `python -m devx.ci.doc_coverage
-   --fail-on-missing`
-5. **Translation completeness check** — `python -m devx.ci.check_translations`
-6. **Dependency security scan** — `pip-audit --desc --skip-editable`
-   (best-effort, non-blocking)
-7. **Workflow dry-run validation** — `make workflow-dryrun` via act_runner
-   (best-effort, skipped if act_runner is not installed)
-
-**`detect-changes` step**
-
-Classifies changes between `origin/master` and the PR head as user-facing or
-workflow-only using `python -m devx.ci.classify_changes --github-output`.
-Writes `user-facing-changed=true|false` to the job output for use by
-downstream steps.
-
-**`release-dry-run` step**
-
-Only runs if the detect-changes step detected user-facing changes. Runs
-`python -m devx.ci.release --dry-run` to validate that the release script
-can calculate the next version and generate the changelog without making
-changes. Non-blocking (uses `|| true`).
-
-**`pr-review` step**
-
-Runs on every pull request. Executes `python -m devx.ci.pr_review` with the
-PR number and repository. Fetches the PR diff via the Gitea API and runs
-automated checks, posting a structured review:
-
- `COMMENT` — no issues found
- `REQUEST_CHANGES` — issues found that must be addressed
-
-Checks performed:
-1. Architecture compliance — no subprocess in CLI, no hardcoded URLs
-2. Best practices — no `print()`, no bare `except`, no `TODO`/`FIXME`,
-   no functions > 50 lines
-3. Security — no hardcoded secrets, no `shell=True`, no `eval`/`exec`
-4. i18n — no raw strings in `click.echo()` without `_()` wrapper
-5. Resource management — no `open()` without `with`, no `Popen()` without
-   cleanup
-6. Documentation — source changes must include doc updates
-7. Test coverage — source changes must include test updates
-8. Commit conventions — conventional commit format on PR commits
-
-**Pre-merge validation step**
-
-Runs on every pull request. Executes
-`python -m devx.ci.check_auto_merge_ready` with the branch name, PR title,
-repository, and PR number. Validates auto-merge preconditions before the
-`auto-merge` job runs:
-
-1. **Branch name** — must contain a valid task ID (for example,
-   `DEVX-12-fix-foo` → `DEVX-12`)
-2. **PR title format** — must be `{PREFIX}-N: <vikunja task title>`
-3. **Vikunja task** — must exist and the title must match the PR title
-4. **Branch state** — must not be behind master
-
-#### `auto-merge`
-
-Depends on `validate`. The final job in the CI workflow. Runs
-`python -m devx.ci.auto_merge` with the branch name, PR title, repository,
-and PR number:
-
-1. **Read task ID** from branch name (for example, `DEVX-12-fix-foo` → `DEVX-12`)
-2. **Validate PR title format** — must be `{PREFIX}-N: <vikunja task title>`
-3. **Validate PR title matches Vikunja task** — fetches the Vikunja task and
-   compares the title
-4. **Extract conventional commit message** from PR commits (newest matching
-   conventional format)
-5. **Squash-merge** with title `{PREFIX}-N <conventional commit message>`
-6. If the head branch is behind master (HTTP 405), automatically pulls master,
-   rebases, force-pushes, and retries the merge
-
-The merge commit push to master triggers the post-merge workflow.
-
-### Smart CI: user-facing vs workflow-only changes
-
-Not all changes require a new release. The `detect-changes` step in the
-`validate` job classifies changes using
-`python -m devx.ci.classify_changes`:
-
-**Workflow-only paths** (infrastructure — no release needed):
- `.gitea/**` — Gitea Actions workflows
- `tests/**` — Test files
- `AGENTS.md`, `README.md`, `CHANGELOG.md` — Project docs
- `Makefile`, `cliff.toml`, `.pre-commit-config.yaml` — Config
- `.env.example`, `.gitignore` — Config
- `hooks/**` — Git hooks
- `src/devx/__init__.py` — Only contains `__version__` (release artifact)
-
-**User-facing paths** (tool changes — release needed) — everything else:
- `src/devx/**` — Python package source (except `__init__.py`)
- `pyproject.toml` — Package metadata
- Any new file type not in the allowlist
-
-Classification is configured in `pyproject.toml` under
-`[tool.devx.classify]`. The framework provides `DEFAULT_INFRASTRUCTURE` — a
-curated list of paths that are infrastructure for any Python project. Projects
-inherit these automatically and only specify what is different.
-
-Rule priority (first match wins):
-1. `user_facing_overrides` — safety override (highest priority)
-2. `infrastructure_overrides` — explicit per-file
-3. `infrastructure` — DEFAULT_INFRASTRUCTURE + project-specific patterns
-4. Default: user-facing (safe — any unknown file triggers release)
-
-## Post-merge workflow (`post-merge.yml`)
-
-Runs on every push to master. Consolidated into 2 jobs (from 7) to reduce
-runner overhead: `detect-and-configure` (detect-type + validate-commit-msg +
-configure-repo) and `release-and-maintain` (release + publish + sync-wiki +
-badges + vikunja). Individual steps within `release-and-maintain` are
-conditional on the `detect-and-configure` job's outputs.
-
-### Job dependency graph
-
-```text
-detect-and-configure
-    ├── configure-repo (independent, skip if release commit)
-    ├── detect-type → is-release? is-automated?
-    └── validate-commit-msg (skip if release commit)
-            │
-            ▼
-release-and-maintain (needs detect-and-configure)
-    ├── release (skip if release commit or workflow-only)
-    │       └── publish (if release created a tag)
-    ├── sync-wiki (skip if automated)
-    ├── vikunja (skip if automated)
-    └── badges (always runs)
-```
-
-`sync-wiki` and `vikunja` run only on non-automated commits (that is, real PR
-merges) so that the wiki and task tracker are only updated when a human
-change lands. They skip on release commits and automated commits.
-
-The `badges` step always runs (even on release commits) so badges (tests,
-coverage, version, etc.) are always current. It runs last so it picks up
-any version bump the release step created.
-
-When `release` creates a `release: vX.Y.Z` commit, the release commit's
-post-merge run still updates badges (the version badge picks up the new
-version). Other steps skip. The `publish` step builds and publishes the
-package to the Gitea PyPI registry within the same `release-and-maintain`
-job (it checks out the release tag).
-
-### Post-merge jobs
-
-#### `detect-and-configure`
-
-The first post-merge job. Consolidates the former `detect-type`,
-`validate-commit-msg`, and `configure-repo` jobs. Outputs `is-release`,
-`is-automated`, and `user-facing-changed` for the `release-and-maintain`
-job.
-
-**`detect-type` step**
-
-Checks if the latest commit is a release commit (`release: vX.Y.Z [skip ci]`)
-using `python -m devx.ci.detect_release_commit`. Writes `is-release=true` or
-`is-release=false` (and `is-automated`) to the job output. The
-`release-and-maintain` job uses these to conditionally skip steps for
-release commits.
-
-**`validate-commit-msg` step**
-
-Skips for release/automated commits. Validates the latest commit message
-using `python -m devx.ci.validate_commit_msg --branch master`. On master,
-commits must follow `{PREFIX}-N: <conventional commit>` format (added by
-auto-merge).
-
-**`configure-repo` step**
-
-Ensures branch protection and labels are configured using
-`python -m devx.tools.configure_repo --repo <name> --owner <owner>`:
-
- Sets up master branch protection (required status checks, block on rejected
-  reviews, block on outdated branch)
- Creates standard labels
- Status check contexts read from `DEVX_STATUS_CHECKS` or default to
-  `CI / validate (pull_request)`
-
-On failure, the `notify_failure` step creates a Gitea issue.
-
-#### `release-and-maintain`
-
-Depends on `detect-and-configure`. The second post-merge job. Consolidates
-the former `release`, `publish`, `sync-wiki`, `badges`, and `vikunja` jobs.
-Individual steps are conditional on the `detect-and-configure` job's outputs.
-
-**`release` step**
-
-Skips for release commits and workflow-only changes. The core release
-automation step. Runs `python -m devx.ci.release`:
-
-1. **Classify changes** — calls `classify_changes.py` to check for user-facing
-   changes. If only infrastructure files changed, exits without releasing.
-2. **Calculate next version** — uses git-cliff to determine the next semver
-   version from conventional commits since the last tag
-3. **Update version file** — updates `__version__` in `src/devx/__init__.py`
-4. **Update changelog** — prepends the new version section to `CHANGELOG.md`
-   using git-cliff output
-5. **Run tests** — executes `make lint-ruff` and `make pytest-cov` to verify
-   the release is healthy. If either fails, the release is aborted — no
-   commit, no tag. Use `--skip-tests` only for emergency releases.
-6. **Commit** — stages the version file and changelog, commits with
-   `release: vX.Y.Z [skip ci]` (uses `--no-verify` to bypass the commit-msg
-   hook since release commits are a special case)
-7. **Create tag** — creates an annotated tag `vX.Y.Z` with the changelog as
-   the tag message
-8. **Push** — pushes both the commit and tag to master
-
-The script is idempotent: if there are no new conventional commits since the
-last tag, it exits without doing anything. If the tag already exists (for example,
-from a partial previous run), it skips tag creation and only pushes.
-
-**Tag consistency**: Before releasing, the script fetches remote tags and
-verifies all existing tags point to commits whose message matches the tag
-version. This prevents duplicate release commits and ensures
-tag/version/commit alignment.
-
-**Version bumping rules** (git-cliff):
-
-| Commit type | Version bump |
-|-------------|-------------|
-| `feat:` | minor (0.X.0) |
-| `fix:` | patch (0.0.X) |
-| `feat!:` or `BREAKING CHANGE` | minor (pre-1.0) |
-| `chore:`, `ci:`, `docs:` | no bump (excluded by cliff.toml) |
-
-On failure, the `notify_failure` step creates a Gitea issue via
-`python -m devx.ci.notify_failure`.
-
-**`sync-wiki` step**
-
-Skips for automated commits. Syncs documentation from `docs/` to the Gitea
-wiki using `python -m devx.ci.sync_wiki --repo <owner/repo> --strict`:
-
-1. Reads `docs/mapping.json` to map file paths to wiki page titles
-2. Lists existing wiki pages via the Gitea API
-3. For each mapped file, reads content and creates or updates the wiki page
-4. `--strict` runs a full integrity check: verifies page count, missing
-   pages, stale pages, and content match. Fails if any page is empty or
-   content doesn't match.
-
-Pages that exist in the wiki but not in the mapping are left untouched (not
-deleted).
-
-On failure, the `notify_failure` step creates a Gitea issue.
-
-**`badges` step**
-
-Always runs (even on release commits). Generates and pushes quality badges
-using `python -m devx.ci.push_badges`:
-
-1. **Fetch latest master** — `git fetch origin master && git reset --hard
-   origin/master` (ensures the version badge reflects the current state,
-   even if the release step recently pushed a new version)
-2. **Generate badges** — calls `devx.tools.generate_badges` which runs
-   pytest-cov, doc-coverage, lint checks, and version extraction, then writes
-   SVG files: `coverage.svg`, `tests.svg`, `docs.svg`, `quality.svg`,
-   `version.svg`, `python.svg`
-3. **Push to badges branch** — creates an orphan `badges` branch, copies SVG
-   files, commits, and force-pushes
-4. **Update README/docs** — switches back to master, replaces
-   `raw/branch/badges/<name>.svg` URLs with `raw/commit/<sha>/<name>.svg`
-   URLs (cache-busting — Gitea caches `raw/branch/` URLs for 6 hours),
-   commits, and pushes
-
-Supports `--retries` for retrying on git push failures (fetches latest master
-and waits 10s between attempts).
-
-On failure, the `notify_failure` step creates a Gitea issue.
-
-**`vikunja` step**
-
-Skips for automated commits. Updates the Vikunja task after a merge using
-`python -m devx.ci.post_merge --git-sha <sha>`:
-
-1. Extracts the task ID from the first line of the commit message
-2. Marks the corresponding Vikunja task as done
-3. Posts a comment with the merge SHA
-
-On failure, the `notify_failure` step creates a Gitea issue.
-
-**`publish` step**
-
-Only runs if the `release` step created a tag. Builds and publishes the
-package within the same `release-and-maintain` job (checks out the release
-tag). Runs `python -m devx.ci.publish <tag> <owner/repo>`:
-
-1. **Install dependencies** — build, twine, requests, python-dotenv, click,
-   and the project itself
-2. **Install CI tools** — git-cliff and tea via
-   `python -m devx.tools.install_tools`
-3. **Configure tea login** — `tea login add` using `CI_GITEA_TOKEN`
-4. **Build and publish** — `python -m devx.ci.publish <tag> <owner/repo>`:
-   - Build the package with `python -m build`
-   - Publish to the Gitea PyPI registry (default) using `twine upload
-     --repository-url <url> -u <token> -p <token>`
-   - OR publish to standard PyPI if `PYPI_TOKEN` is set
-   - OR skip publishing if `--skip-build` is passed (non-Python repos)
-   - Create a Gitea release with git-cliff-generated release notes via
-     `tea create release`
-
-Publishing destination resolution (checked in order):
-1. **Gitea PyPI registry** — if `--registry-url` is given, or
-   `DEVX_PYPI_REGISTRY_URL` env var is set, or derived from `GITEA_API_URL`
-2. **Standard PyPI** — if `PYPI_TOKEN` is set (takes precedence over Gitea
-   registry)
-3. **Skip** — if neither is configured, only the Gitea release is created
-
-On failure, the `notify_failure` step creates a Gitea issue.
-
-## CI scripts
-
-### `auto_merge.py`
-
-Auto-merge PR when all CI checks pass. Reads task ID from the branch name
-(for example, `DEVX-12-fix-foo` → `DEVX-12`). Validates PR title format, checks the
-Vikunja task exists and the title matches, extracts the conventional commit
-message from PR commits, and squash-merges with
-`{PREFIX}-N <conventional commit>` title.
-
-```bash
-python -m devx.ci.auto_merge <branch> <pr_title> <owner/repo> <pr_number>
-```
-
-### `release.py`
-
-Automated release using git-cliff. Calculates next semver version from
-conventional commits, updates `__version__` and `CHANGELOG.md`, runs lint and
-tests, commits with `release: vX.Y.Z [skip ci]`, creates annotated tag, and
-pushes. Idempotent — exits if no unreleased changes.
-
-```bash
-python -m devx.ci.release [--dry-run] [--skip-tests] [--verify]
-```
-
- `--dry-run` — preview without making changes
- `--skip-tests` — skip lint and test verification (emergency only)
- `--verify` — check tag/version/changelog alignment and exit
-
-### `publish.py`
-
-Builds package, publishes to Gitea PyPI registry or standard PyPI, and
-creates a Gitea release with git-cliff-generated notes.
-
-```bash
-python -m devx.ci.publish <tag> <owner/repo> [--registry-url <url>] [--skip-build]
-```
-
-### `pr_review.py`
-
-Automated PR review. Fetches the PR diff via the Gitea API, runs automated
-checks (architecture, best practices, security, i18n, resource management,
-documentation, test coverage, commit conventions), and posts a structured
-review with inline comments.
-
-```bash
-python -m devx.ci.pr_review <pr_number> <owner/repo>
-```
-
-### `notify_failure.py`
-
-Creates a Gitea issue when a CI workflow fails. Uses the tea CLI for issue
-creation with failure labels. Supports `--auto-login` to configure the tea
-CLI login profile from `CI_GITEA_TOKEN`.
-
-```bash
-python -m devx.ci.notify_failure --repo <owner/repo> --run-id <id> \
-  --workflow <name> --commit <sha> [--auto-login]
-```
-
-### `post_merge.py`
-
-Updates Vikunja task after a merge to master. Extracts task ID from the
-commit message, marks the task as done, and posts a comment with the merge SHA.
-
-```bash
-python -m devx.ci.post_merge <commit_msg> [--commit-sha <sha>] [--git-sha <sha>]
-```
-
-### `classify_changes.py`
-
-Classifies git changes as user-facing or workflow-only. Uses a layered rule
-system configured in `pyproject.toml`. Safe-by-default: any unknown file
-defaults to user-facing.
-
-```bash
-python -m devx.ci.classify_changes [--base <ref>] [--head <ref>] \
-  [--quiet] [--check <category>] [--github-output]
-```
-
-### `discover_runners.py`
-
-Discovers available Gitea Actions runners at repository, organization, and
-instance levels. Falls back to `MOLECULE_RUNNERS` repo variable or
-`DEFAULT_MAX_RUNNERS` (3).
-
-```bash
-python -m devx.ci.discover_runners --owner <owner> --repo <repo> [--count] [--indices]
-```
-
-### `detect_release_commit.py`
-
-Detects whether the latest git commit is a release commit. Writes
-`is-release=true|false` to `$GITHUB_OUTPUT`.
-
-```bash
-python -m devx.ci.detect_release_commit
-```
-
-### `push_badges.py`
-
-Generates SVG badge files, pushes them to the `badges` branch, and updates
-README.md and docs/index.md with cache-busting `raw/commit/<sha>/` URLs.
-
-```bash
-python -m devx.ci.push_badges [--output-dir <dir>] [--branch <branch>] \
-  [--no-readme-update] [--retries <n>]
-```
-
-### `distribute_molecule.py`
-
-Distributes molecule (scenario, platform) pairs across N parallel runners.
-Discovers scenarios under `ansible/roles/*/molecule/`.
-
-```bash
-python -m devx.molecule.distribute_molecule --runner-index <i> --max-runners <n>
-python -m devx.molecule.distribute_molecule --list
-python -m devx.molecule.distribute_molecule --list-platforms
-```
-
-### `molecule_ci_guard.py`
-
-Runs molecule tests sequentially while polling the Gitea API for other runner
-failures. Aborts early if another runner fails the same job.
-
-```bash
-python -m devx.molecule.molecule_ci_guard [--roles-root <dir>] pair1 pair2 ...
-```
-
-### `validate_commit_msg.py`
-
-Validates commit messages. On feature branches: conventional commits only
-(no `{PREFIX}-N` prefix). On master: must have `{PREFIX}-N` prefix from
-auto-merge, followed by a conventional commit message.
-
-```bash
-python -m devx.ci.validate_commit_msg <commit_msg_file> [--branch <branch>]
-```
-
-### `sync_wiki.py`
-
-Syncs documentation from `docs/` to the Gitea wiki via the API. Reads
-`docs/mapping.json` for file-to-page mapping. Supports `--dry-run`,
-`--verify`, and `--strict` (full integrity check).
-
-```bash
-python -m devx.ci.sync_wiki [--dry-run] [--repo <owner/repo>] [--verify] [--strict]
-```
-
-### `check_translations.py`
-
-Validates translation files against the Python source code. Checks for
-missing keys, dead keys, and missing languages.
-
-```bash
-python -m devx.ci.check_translations [--translations <file>]...
-```
-
-### `doc_coverage.py`
-
-Checks documentation coverage for CLI commands and major modules. Parses
-Click commands from `cli.py` and verifies documentation exists.
-
-```bash
-python -m devx.ci.doc_coverage [--docs-dir <dir>] [--fail-on-missing]
-```
-
-### `distribute_files.py`
-
-Distributes files matching a glob pattern across N parallel runners
-(round-robin). Writes the assigned file list to `$GITHUB_ENV`.
-
-```bash
-python -m devx.ci.distribute_files --pattern <glob> --runner-index <i> \
-  --max-runners <n> [--github-env] [--skip-if-excess]
-```
-
-### `integration_guard.py`
-
-Runs pytest with cross-runner failure detection. If any other
-integration-tests matrix runner reports failure, the current pytest
-subprocess is killed and this runner exits early.
-
-```bash
-python -m devx.ci.integration_guard -- <pytest args>
-```
-
-## Release process summary
-
-The complete release process from PR to published package:
-
-1. **PR merged** — `auto-merge` squash-merges the PR to master with
-   `{PREFIX}-N <conventional commit>` title
-2. **Post-merge triggers** — the merge push triggers `post-merge.yml`
-3. **detect-and-configure** — detects release commit, validates commit
-   message, and ensures branch protection/labels
-4. **release** (step in `release-and-maintain`) — `release.py` calculates
-   the next version, updates files, runs tests, commits
-   `release: vX.Y.Z [skip ci]`, creates tag `vX.Y.Z`, and pushes to master
-5. **publish** (step in `release-and-maintain`) — `publish.py` builds the
-   package, publishes to the Gitea PyPI registry, and creates a Gitea
-   release with git-cliff notes (checks out the release tag within the
-   same job)
-6. **sync-wiki** (step in `release-and-maintain`) — documentation is synced
-   to the Gitea wiki
-7. **vikunja** (step in `release-and-maintain`) — the corresponding Vikunja
-   task is marked as done
-8. **badges** (step in `release-and-maintain`) — quality badges are
-   regenerated and pushed to the `badges` branch; README and docs/index.md
-   are updated with cache-busting URLs
-
-The release commit's post-merge run skips all steps except `badges` (which
-picks up the new version number). This prevents infinite loops.
-
-## Failure handling
-
-Every job in the CI and post-merge workflows has a `notify_failure` step
-that runs `if: failure()`. This creates a Gitea issue with the workflow name,
-run ID, and commit SHA, ensuring failures that would otherwise go unnoticed
-in the Actions tab are surfaced as issues. The issue is created via the tea
-CLI with a `bug` label if available.
@@ -1,559 +0,0 @@
-# CLI Commands
-
-devx provides a CLI with three command groups: `ci`, `tools`, and `molecule`.
-Each subcommand delegates to the corresponding Python module via
-`python -m devx.*`, so `devx ci release` is equivalent to
-`python -m devx.ci.release`.
-
-```bash
-devx --help        # show all command groups
-devx --version     # show package version
-devx ci --help     # show CI commands
-devx tools --help  # show tools commands
-devx molecule --help  # show molecule commands
-```
-
-## CI Commands
-
-### `devx ci auto-merge`
-
-Auto-merge a PR when all CI checks pass. Reads the task ID from the branch
-name, validates the PR title format against
-the Vikunja task title, extracts the conventional commit message from PR
-commits, and squash-merges with `{PREFIX}-N <conventional commit>` title.
-
-If the head branch is behind master (HTTP 405), automatically pulls master,
-rebases, force-pushes, and retries the merge.
-
-```bash
-devx ci auto-merge <branch> <pr_title> <owner/repo> <pr_number>
-# Example:
-devx ci auto-merge DEVX-12-add-feature "DEVX-12: Add feature" oblachno-oss/devx 42
-```
-
-### `devx ci check-translations`
-
-Check translation files for gaps, dead keys, and missing languages. Validates
-translation files against the Python source code that uses them. By default,
-checks `src/devx/translations.json` against `src/devx/**/*.py`.
-
-Checks performed:
- **Missing keys** — a `_()` call in code has no entry in the translations file
- **Dead keys** — a key in the translations file is not used in any code
- **Missing languages** — a key exists but is missing one of the six
-  supported languages (en, bg, de, ru, zh, pl)
-
-```bash
-devx ci check-translations
-devx ci check-translations --translations path/to/translations.json
-```
-
-### `devx ci classify-changes`
-
-Classify git changes as user-facing or workflow-only. Used to skip releases
-for infrastructure-only changes. Classification rules are configured in
-`pyproject.toml` under `[tool.devx.classify]`.
-
-```bash
-devx ci classify-changes --base origin/master --head HEAD
-devx ci classify-changes --base origin/master --head HEAD --github-output
-devx ci classify-changes --quiet --check user-facing
-devx ci classify-changes --check ansible  # custom tag from pyproject.toml
-```
-
-Options:
- `--base <ref>` — base ref (default: latest tag)
- `--head <ref>` — head ref (default: HEAD)
- `--quiet` — only output true/false
- `--check <category>` — check specific category: `all` (default),
-  `user-facing`, or any tag name defined in `[tool.devx.classify.tags]`
- `--github-output` — write results to `$GITHUB_OUTPUT` for CI workflow steps
-
-Exit code 2 indicates workflow-only changes (no release needed).
-
-### `devx ci detect-release-commit`
-
-Detect whether the latest git commit is a release commit
-(`release: vX.Y.Z [skip ci]`). Writes `is-release=true` or `is-release=false`
-to `$GITHUB_OUTPUT` for use in CI workflow conditionals.
-
-```bash
-devx ci detect-release-commit
-```
-
-### `devx ci discover-runners`
-
-Discover available Gitea Actions runners for dynamic job distribution.
-Queries the Gitea API for registered runners at repository, organization, and
-instance (admin) levels. Falls back to `MOLECULE_RUNNERS` repo variable or
-`DEFAULT_MAX_RUNNERS` (3).
-
-```bash
-devx ci discover-runners --owner oblachno-oss --repo devx
-devx ci discover-runners --owner oblachno-oss --repo devx --count
-devx ci discover-runners --owner oblachno-oss --repo devx --indices
-```
-
-Options:
- `--count` — print the number of available runners
- `--indices` — print a JSON array `[0, 1, ..., N-1]` for use as a dynamic
-  matrix in Gitea Actions
-
-### `devx ci distribute-files`
-
-Distribute files across parallel runners (round-robin). Discovers files
-matching a glob pattern, sorts them for deterministic ordering, then assigns
-them round-robin to `max_runners` groups. The assigned group for
-`runner_index` is written to `$GITHUB_ENV`.
-
-```bash
-devx ci distribute-files --pattern "tests/integration/test_*.py" \
-  --runner-index 1 --max-runners 3 --github-env
-```
-
-Options:
- `--pattern <glob>` — glob pattern for files to distribute
- `--runner-index <i>` — current runner index (0-based)
- `--max-runners <n>` — total number of runners (default: 3)
- `--github-env` — write file list to `$GITHUB_ENV`
- `--skip-if-excess` — skip if fewer files than runners
-
-### `devx ci doc-coverage`
-
-Check documentation coverage for CLI commands and major modules. Parses
-Click commands from `cli.py` and checks if each has documentation in
-`docs/user/cli-commands.md`. Verifies core modules are documented in
-`architecture.md` and CI scripts in `ci-cd-workflow.md`.
-
-```bash
-devx ci doc-coverage
-devx ci doc-coverage --docs-dir docs/ --source-dir src/ --fail-on-missing
-```
-
-Options:
- `--docs-dir <dir>` — path to the docs directory (default: `docs/`)
- `--source-dir <dir>` — path to the source directory (default: auto-detect)
- `--fail-on-missing` — exit with non-zero status if any documentation is
-  missing
-
-### `devx ci lint-docs`
-
-Lint documentation files for structure, broken links, heading hierarchy,
-duplicate headings, TODO/FIXME markers, and trailing whitespace.
-
-```bash
-devx ci lint-docs
-devx ci lint-docs --root . --fix
-devx ci lint-docs --no-check-links --no-check-stale
-```
-
-Options:
- `--root <dir>` — repository root directory (default: `.`)
- `--docs-dir <dir>` — docs directory (default: `<root>/docs`)
- `--check-links/--no-check-links` — check internal links (default: yes)
- `--check-headings/--no-check-headings` — check heading hierarchy (default: yes)
- `--check-todo/--no-check-todo` — check for TODO/FIXME markers (default: yes)
- `--check-stale/--no-check-stale` — check for stale docs (default: no)
- `--check-trailing/--no-check-trailing` — check trailing whitespace (default: yes)
- `--check-duplicates/--no-check-duplicates` — check duplicate headings (default: yes)
- `--fix` — auto-fix trailing whitespace
-
-### `devx ci integration-guard`
-
-Run pytest with cross-runner failure detection. If any
-other integration-tests matrix runner reports failure, the current pytest
-subprocess is killed and this runner exits early with code 1.
-
-```bash
-devx ci integration-guard -- test_a.py test_b.py
-devx ci integration-guard -- -x -v --tb=short test_a.py
-```
-
-Environment variables:
- `GITEA_URL` — base URL of the Gitea instance
- `CI_GITEA_TOKEN` — API token with repo access
- `RUN_ID` — workflow run ID (`GITHUB_RUN_ID`)
- `JOB_NAME` — base job name (`GITHUB_JOB`)
- `MATRIX_INDEX` — current matrix index (runner-index)
- `GITEA_REPOSITORY` — repository in `owner/repo` format
-
-### `devx ci notify-failure`
-
-Create a Gitea issue when a CI workflow fails. Uses the tea CLI for issue
-creation with a `bug` label if available.
-
-```bash
-devx ci notify-failure --repo oblachno-oss/devx --run-id 123 \
-  --workflow ci --commit abc123def456
-devx ci notify-failure --repo oblachno-oss/devx --run-id 123 \
-  --workflow post-merge/release --commit abc123def456 --auto-login
-```
-
-Options:
- `--repo <owner/repo>` — repository (required)
- `--run-id <id>` — CI run ID (required)
- `--workflow <name>` — workflow name (required)
- `--commit <sha>` — commit SHA (required)
- `--auto-login` — configure tea CLI login from `CI_GITEA_TOKEN` before creating
-  the issue
-
-### `devx ci post-merge`
-
-Update Vikunja task after a merge to master. Extracts the task ID from the
-commit message, marks the task as done, and posts a comment with the merge SHA.
-
-```bash
-devx ci post-merge "DEVX-12 feat: add feature" --git-sha abc123def456
-```
-
-### `devx ci pr-review`
-
-Run automated PR review. Fetches the PR diff via the Gitea API and runs a
-series of checks, posting a structured review (`COMMENT` or
-`REQUEST_CHANGES`).
-
-Checks: architecture compliance, best practices, security, i18n, resource
-management, documentation, test coverage, and commit conventions.
-
-```bash
-devx ci pr-review 42 oblachno-oss/devx
-```
-
-### `devx ci publish`
-
-Build package, publish to Gitea PyPI registry (or standard PyPI), and create
-a Gitea release with git-cliff-generated notes.
-
-```bash
-devx ci publish v1.0.0 oblachno-oss/devx
-devx ci publish v1.0.0 oblachno-oss/devx --registry-url https://git.example.com/api/packages/owner/pypi
-devx ci publish v1.0.0 oblachno-oss/devx --skip-build  # Gitea release only
-```
-
-Options:
- `--registry-url <url>` — Gitea PyPI registry URL. Defaults to
-  `DEVX_PYPI_REGISTRY_URL` env var or a URL derived from `GITEA_API_URL`.
-  When set, publishes to Gitea PyPI instead of standard PyPI (unless
-  `PYPI_TOKEN` is also set).
- `--skip-build` — skip package build and PyPI publish (for non-Python repos
-  that only need a Gitea release)
-
-### `devx ci push-badges`
-
-Generate badge SVG files and push them to the `badges` branch. Also updates
-`README.md` and `docs/index.md` on master with cache-busting
-`raw/commit/<sha>/` URLs.
-
-```bash
-devx ci push-badges
-devx ci push-badges --output-dir .badges/ --branch master
-devx ci push-badges --no-readme-update  # skip README update (local testing)
-devx ci push-badges --retries 3  # retry on git push failures
-```
-
-Options:
- `--output-dir <dir>` — temporary directory for badge files (default:
-  `.badges/`)
- `--branch <branch>` — branch to sync before generating badges (default:
-  `master`)
- `--no-readme-update` — skip updating README with cache-busting URLs
- `--retries <n>` — number of attempts on git push failures (default: 1).
-  Between attempts, fetches latest master and waits 10s.
-
-### `devx ci release`
-
-Automated release: calculate next version, update files, tag, and push. Uses
-git-cliff to determine the next semver version from conventional commits.
-
-```bash
-devx ci release
-devx ci release --dry-run          # preview without making changes
-devx ci release --skip-tests       # skip lint and tests (emergency only)
-devx ci release --verify           # check tag/version/changelog alignment
-```
-
-Options:
- `--dry-run` — show what would happen without making changes
- `--skip-tests` — skip lint and test verification (NOT recommended — only
-  for emergency releases)
- `--verify` — verify tag/version/changelog alignment and exit (no changes
-  made)
-
-### `devx ci sync-wiki`
-
-Sync documentation from `docs/` to the Gitea wiki. Reads `docs/mapping.json`
-for file-to-page mapping. Pages that exist in the wiki but not in the mapping
-are left untouched.
-
-```bash
-devx ci sync-wiki --repo oblachno-oss/devx
-devx ci sync-wiki --repo oblachno-oss/devx --dry-run
-devx ci sync-wiki --repo oblachno-oss/devx --verify
-devx ci sync-wiki --repo oblachno-oss/devx --strict
-```
-
-Options:
- `--dry-run` — show what would happen without making changes
- `--repo <owner/repo>` — repository (auto-detected if omitted)
- `--verify` — after syncing, verify each page has non-empty content. Exit 1
-  if any page is empty or mismatched.
- `--strict` — full integrity check: verify page count, missing pages, stale
-  pages, and content. Implies `--verify`.
-
-### `devx ci validate-commit-msg`
-
-Validate commit messages for conventional commit format. On feature branches:
-conventional commits only (no `{PREFIX}-N` prefix). On master: must have
-`{PREFIX}-N` prefix from auto-merge, followed by a conventional commit
-message.
-
-```bash
-devx ci validate-commit-msg commit-msg.txt
-devx ci validate-commit-msg commit-msg.txt --branch master
-```
-
-Options:
- `--branch <branch>` — override branch detection (for CI use)
-
-## Tools Commands
-
-### `devx tools check-test-speed`
-
-Run unit tests and enforce execution-time budgets. Two quality gates:
-
- **Total suite time** must not exceed `--max-seconds` (default: 10s)
- **Per-test time** — no individual test may exceed `--max-single-seconds`
-  (default: 0.5s, 0 to disable)
-
-Runs `make test-unit` with `PYTEST_ADDOPTS=--durations=0` so pytest emits
-per-test timing lines.
-
-```bash
-devx tools check-test-speed
-devx tools check-test-speed --max-seconds 10
-devx tools check-test-speed --max-seconds 4 --max-single-seconds 0.5
-```
-
-### `devx tools check-test-isolation`
-
-Statically analyze test files for un-hermetic patterns that cause slow
-or flaky tests. Also available as a **pytest plugin** (auto-discovered
-via the `pytest11` entry point when devx is installed — runs
-automatically on every `pytest` invocation and **fails on violations**).
-
-Detected patterns (hard errors — exit non-zero):
-
- **unpatched-subprocess**: `subprocess.run/call/Popen/check_call/check_output`
-  called in a test function without `@patch` or `with patch(...)`
- **unpatched-sleep**: `time.sleep` called without `@patch`
- **unpatched-helper**: known subprocess-spawning helpers (`update_doc_versions`,
-  `run_cmd`, `run_tests`) called without `@patch` or patching their internal deps
- **excessive-iterations**: `for _ in range(N)` where N > 100
- **heavy-module-import**: `httpx`, `ansible`, etc. imported at module level
- **reload-without-cleanup**: `importlib.reload()` called an odd number of times
-
-Advisory patterns (exit 0 — runtime audit is authoritative):
-
- **transitive-subprocess**: `CliRunner.invoke(target)` where `target`
-  transitively calls `subprocess.run` without being patched. Detected via
-  static call-graph analysis. The runtime subprocess audit catches actual
-  leaks — if a real subprocess runs without `@patch`, the test fails.
-
-```bash
-devx tools check-test-isolation
-devx tools check-test-isolation --test-path tests/
-devx tools check-test-isolation --categories unpatched-subprocess,transitive-subprocess
-devx tools check-test-isolation --max-loop-iterations 50
-devx tools check-test-isolation --src-dir src/
-```
-
-Pytest plugin options (automatic when devx is installed):
-
- `--no-test-isolation` — disable static analysis and runtime subprocess audit
- `--test-isolation-max-loop N` — max iterations per loop (default: 100)
-
-### `devx tools configure-repo`
-
-Configure repository: branch protection and labels via the Gitea REST API.
-Sets up master branch protection (required status checks, block on rejected
-reviews, block on outdated branch) and creates standard labels.
-
-```bash
-devx tools configure-repo --repo devx --owner oblachno-oss
-```
-
-Status check contexts are read from `DEVX_STATUS_CHECKS` (comma-separated) or
-default to `CI / quality (pull_request)`.
-
-### `devx tools generate-badges`
-
-Generate self-contained SVG badge files from project metrics. Runs
-pytest-cov, doc-coverage, lint checks, and version extraction, then writes
-SVG files that can be served as static files from the Gitea raw file API.
-
-Badges generated: `coverage.svg`, `tests.svg`, `docs.svg`, `quality.svg`,
-`version.svg`, `python.svg`.
-
-```bash
-devx tools generate-badges
-devx tools generate-badges --output-dir .badges/
-```
-
-### `devx tools generate-cliff-config`
-
-Generate a `cliff.toml` configuration file with the correct task ID prefix
-preprocessor. Eliminates the need to manually duplicate and maintain
-`cliff.toml` across repos that use devx.
-
-```bash
-devx tools generate-cliff-config --prefix GRM
-devx tools generate-cliff-config --prefix GRM --output cliff.toml
-devx tools generate-cliff-config --prefix GRM --force  # overwrite existing
-```
-
-Options:
- `--prefix <prefix>` — task ID prefix (default: `DEVX_TASK_PREFIX` env var
-  or `DEVX`)
- `--output <file>` — output file path (default: `cliff.toml`)
- `--force` — overwrite existing file
-
-### `devx tools install-checkmake`
-
-Install checkmake (Makefile linter) if not already present. Tries
-`go install` first if Go is available, otherwise downloads the latest
-pre-built Linux binary from the official GitHub releases.
-
-```bash
-devx tools install-checkmake
-```
-
-### `devx tools install-tools`
-
-Install CI/CD development tools that are not Python packages: actionlint,
-git-cliff, act_runner, and tea. Each tool is installed to `~/.local/bin` if
-not already on PATH. Idempotent: skips tools that are already available.
-
-```bash
-devx tools install-tools                    # install all
-devx tools install-tools --tool actionlint  # install one
-devx tools install-tools --tool git-cliff --tool tea  # install specific
-devx tools install-tools --list             # list status
-```
-
-### `devx tools setup`
-
-Project setup: install Python dependencies (editable mode with extras),
-Ansible Galaxy collections (if `ansible/requirements.yml` exists in the target repo), pre-commit
-hooks (pre-commit, commit-msg, pre-push), and configure the tea CLI login
-profile from `.env`.
-
-```bash
-devx tools setup --bin .venv/bin
-devx tools setup --bin .venv/bin --extras "ci,lint"
-devx tools setup --bin .venv/bin --no-pre-commit --no-tea-login
-```
-
-Options:
- `--bin <dir>` — virtualenv bin directory (required)
- `--extras <groups>` — pip extras to install (default: `dev`)
- `--no-pre-commit` — skip pre-commit hook installation
- `--no-tea-login` — skip tea CLI login configuration
-
-### `devx tools rebase`
-
-Rebase the current branch onto `origin/master` and force-push with
-`--force-with-lease`. Checks if the branch is behind master first —
-if up-to-date, exits without doing anything.
-
-```bash
-devx tools rebase                          # rebase + force-push
-devx tools rebase -- --no-push             # rebase locally only
-```
-
-Options (pass after `--`):
- `--no-push` — rebase locally without pushing
-
-### `devx tools pr-rebase`
-
-Rebase a pull request's head branch onto master via the Gitea API
-(server-side). This triggers a new `pull_request synchronize` event,
-which starts a new CI run. Useful when you don't have the branch
-checked out locally.
-
-```bash
-devx tools pr-rebase -- --pr 42            # rebase PR #42
-devx tools pr-rebase                       # auto-detect PR from current branch
-```
-
-Options (pass after `--`):
- `--pr <N>` — PR number (auto-detected from current branch if omitted)
-
-## Molecule Commands
-
-Molecule commands require the `molecule` extra (`pip install devx[molecule]`).
-
-### `devx molecule all`
-
-Run all molecule scenarios on all supported OS platforms. Sequential
-execution — CI uses the parallel matrix instead.
-
-```bash
-devx molecule all
-devx molecule all --bin .venv/bin
-```
-
-### `devx molecule discover-runners`
-
-Discover available Gitea Actions runners for molecule tests. Same logic as
-`devx ci discover-runners` but intended for molecule-specific workflows.
-
-```bash
-devx molecule discover-runners --owner oblachno-oss --repo devx --indices
-```
-
-### `devx molecule distribute`
-
-Distribute molecule (scenario, platform) pairs across N parallel runners.
-Discovers scenarios under `ansible/roles/*/molecule/` and crosses them with
-the supported OS platform matrix.
-
-```bash
-devx molecule distribute --runner-index 1 --max-runners 3
-devx molecule distribute --list              # list all scenarios
-devx molecule distribute --list-platforms    # list platforms
-devx molecule distribute --roles-root ansible/roles  # multi-role repos
-```
-
-Options:
- `--runner-index <i>` — current runner index (0-based)
- `--max-runners <n>` — total number of runners (default: 3)
- `--list` — list all scenarios, one per line
- `--list-platforms` — list all platforms, one per line
- `--roles-root <dir>` — roles root directory for multi-role repos (default:
-  `ansible/roles`)
-
-### `devx molecule guard`
-
-Run molecule tests sequentially with CI failure polling. A background thread
-polls the Gitea API. If any other molecule matrix runner reports failure, the
-current molecule subprocess is killed and this runner exits early with code 1.
-
-```bash
-devx molecule guard pair1 pair2 pair3
-devx molecule guard --roles-root ansible/roles pair1 pair2
-```
-
-Each pair is encoded as:
- **Single-role (4-part):** `scenario|platform_name|platform_image|platform_command`
- **Multi-role (5-part):** `role|scenario|platform_name|platform_image|platform_command`
-
-Options:
- `--roles-root <dir>` — roles root directory for multi-role repos
-
-Environment variables:
- `GITEA_URL` — base URL of the Gitea instance
- `CI_GITEA_TOKEN` — API token with repo access
- `RUN_ID` — workflow run ID (`GITHUB_RUN_ID`)
- `JOB_NAME` — base job name (`GITHUB_JOB`)
- `MATRIX_INDEX` — current matrix index (runner-index)
- `GITEA_REPOSITORY` — repository in `owner/repo` format
@@ -1,161 +0,0 @@
-# Getting Started with devx
-
-This guide walks you through installing devx, configuring it for your project,
-and setting up a complete CI/CD pipeline.
-
-## Prerequisites
-
- **Python 3.12+**
- **A Gitea instance** with Actions enabled
- **A Gitea API token** with repo, workflow, and organization scopes
- **(Optional) Vikunja API token** for task tracking integration
-
-## Installation
-
-devx is published to the Gitea PyPI registry. Configure pip to use it:
-
-```bash
-# Configure Gitea PyPI registry
-pip config set global.extra-index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
-
-# Install devx
-pip install devx
-```
-
-Or install from source:
-
-```bash
-git clone https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git
-cd devx
-make setup
-```
-
-## Quick Start
-
-### 1. Configure environment variables
-
-Create a `.env` file in your project root:
-
-```bash
-CI_GITEA_TOKEN=your_gitea_api_token
-VIKUNJA_TOKEN=your_vikunja_api_token  # optional
-```
-
-### 2. Add devx to your project
-
-Add devx to your `pyproject.toml`:
-
-```toml
-[project]
-dependencies = [
-    "devx>=0.48.1",
-]
-
-[project.optional-dependencies]
-dev = [
-    "devx>=0.48.1",
-]
-```
-
-### 3. Set up the Makefile
-
-devx provides a shared Makefile fragment. Add this to your `Makefile`:
-
-```makefile
-include devx.mak
-```
-
-Run `devx tools setup` to install all development tools (actionlint, git-cliff,
-tea CLI, etc.) and configure pre-commit hooks.
-
-### 4. Create the docs structure
-
-devx expects a `docs/` directory with at minimum:
-
-```text
-docs/
-├── index.md          # Documentation home page
-├── mapping.json      # Wiki page title mappings
-├── user/             # User-facing documentation
-│   └── cli-commands.md
-└── tech/             # Technical documentation
-    ├── architecture.md
-    └── ci-cd-workflow.md
-```
-
-Example `docs/mapping.json`:
-
-```json
-{
-  "index.md": "Home",
-  "user/cli-commands.md": "CLI-Commands",
-  "tech/architecture.md": "Architecture",
-  "tech/ci-cd-workflow.md": "CI-CD-Workflow"
-}
-```
-
-### 5. Set up CI workflows
-
-Create `.gitea/workflows/ci.yml` and `.gitea/workflows/post-merge.yml` in your
-project. See the [CI/CD Workflow guide](../tech/ci-cd-workflow.md) for details.
-
-### 6. Configure release settings
-
-Add a `cliff.toml` for git-cliff-based versioning:
-
-```bash
-devx tools generate-cliff-config
-```
-
-Add `[tool.devx]` section to `pyproject.toml` for project-specific config:
-
-```toml
-[tool.devx]
-# Vikunja project ID for task tracking
-vikunja_project_id = 6
-
-[tool.devx.classify]
-# File patterns that are infrastructure (no release needed)
-infrastructure = [
-    ".gitea/**",
-    "docs/**",
-    "tests/**",
-    "AGENTS.md",
-    "README.md",
-    "CHANGELOG.md",
-]
-```
-
-## Available Tools
-
-### CI/CD Automation (`devx.ci.*`)
-
- `devx.ci.release` — Automated semver versioning and tagging
- `devx.ci.publish` — Package publishing to Gitea PyPI registry
- `devx.ci.auto_merge` — Squash-merge automation with task ID validation
- `devx.ci.pr_review` — Automated PR review with inline comments
- `devx.ci.classify_changes` — User-facing vs workflow-only change detection
- `devx.ci.sync_wiki` — Push docs/ to Gitea wiki
- `devx.ci.doc_coverage` — Documentation coverage checker
- `devx.ci.lint_docs` — Documentation linter (structure, links, headings)
- `devx.ci.check_translations` — i18n translation completeness checker
- `devx.ci.notify_failure` — Create Gitea issues on CI failures
- `devx.ci.distribute_files` — Parallel test file distribution
- `devx.ci.distribute_items` — Parallel item distribution across runners
- `devx.ci.discover_runners` — Dynamic runner discovery via Gitea API
-
-### Development Tools (`devx.tools.*`)
-
- `devx.tools.setup` — Environment setup (venv, deps, hooks, tools)
- `devx.tools.install_tools` — Install CI/CD tools (actionlint, git-cliff, tea)
- `devx.tools.create_task` — Create Vikunja tasks
- `devx.tools.create_pr` — Create Gitea PRs with task ID in title
- `devx.tools.configure_repo` — Configure branch protection and labels
- `devx.tools.generate_badges` — Generate quality badge SVGs
- `devx.tools.check_test_speed` — Enforce test execution speed limits
-
-## Next Steps
-
- Read the [CLI Commands reference](cli-commands.md) for all available commands
- Read the [Architecture guide](../tech/architecture.md) to understand internals
- Read the [CI/CD Workflow guide](../tech/ci-cd-workflow.md) for pipeline details
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-# pre-commit hook: fast local quality gates that shift-left CI checks.
-# Runs test speed, translation completeness, and test isolation checks.
-# All of these run in CI — failing here saves a round-trip.
-set -e
-export PYTHONPATH=src
-
-# Test speed: total suite < 4s, individual tests < 0.5s
-python3 -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
-
-# Translation completeness: missing keys, dead keys, missing languages
-python3 -m devx.ci.check_translations
-
-# Test isolation: unpatched subprocess/time.sleep in test functions
-python3 -m devx.tools.check_test_isolation --test-path tests/
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-# pre-push hook: run full test suite with 100% coverage enforcement.
-set -e
-export PYTHONPATH=src
-.venv/bin/pytest tests/ -v --cov=src/devx --cov-report=term-missing --cov-fail-under=100
@@ -1,183 +0,0 @@
-[build-system]
-requires = ["setuptools>=61.0", "wheel"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "devx"
-dynamic = ["version"]
-description = "Reusable development and CI/CD tools for oblachno-oss projects"
-readme = "README.md"
-license = {text = "GPL-3.0"}
-requires-python = ">=3.12"
-classifiers = [
-    "Programming Language :: Python :: 3",
-    "License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
-]
-# All dependencies are pinned to exact versions for full reproducibility.
-# Update pinned versions in a dedicated PR with verification.
-dependencies = [
-    "requests==2.34.2",
-    "python-dotenv==1.2.2",
-    "click==8.4.2",
-    "tenacity==9.1.4",  # retry logic for GiteaClient/VikunjaClient
-]
-
-[project.scripts]
-devx = "devx.cli:cli"
-
-# Pytest plugin — auto-discovered by pytest when devx is installed.
-# Runs static analysis on test files during every pytest invocation
-# to detect un-hermetic patterns (unpatched subprocess, time.sleep, etc.)
-[project.entry-points.pytest11]
-devx_test_isolation = "devx.tools.check_test_isolation"
-
-[tool.setuptools.dynamic]
-version = {attr = "devx.__version__"}
-
-[project.optional-dependencies]
-# Test runners (pytest + coverage + parallel execution)
-ci = [
-    "pytest==9.1.1",
-    "pytest-cov==7.1.0",
-    "pytest-xdist==3.8.0",
-]
-# Lint and type-checking tools (quality job, badge generation)
-lint = [
-    "ruff==0.15.21",
-    "pyright==1.1.411",
-    "bandit==1.9.4",
-    "pip-audit==2.10.1",
-    "pre-commit==4.6.0",
-]
-# Release tools (build + publish to PyPI/Gitea registry)
-release = [
-    "build==1.5.1",
-    "twine==6.2.0",
-]
-# Molecule testing (for projects with Ansible roles)
-molecule = [
-    "molecule==26.6.0",
-    "molecule-docker==2.1.0",
-    "ansible-lint==26.6.0",
-    "ansible-core==2.21.1",
-]
-# Deploy tools (for infra staging/production deployments)
-deploy = [
-    "ansible-core==2.21.1",
-    "boto3==1.43.37",
-    "docker==7.1.0",
-    "jinja2==3.1.6",
-    "pyyaml==6.0.3",
-    "cryptography==49.0.0",
-]
-# Full dev environment (local development)
-dev = [
-    "devx[ci,lint,release,molecule]",
-    "build==1.5.1",
-    "twine==6.2.0",
-]
-
-[tool.setuptools.packages.find]
-where = ["src"]
-
-[tool.setuptools.package-data]
-devx = ["translations.json", "make/*.mak"]
-
-[tool.pytest.ini_options]
-testpaths = ["tests"]
-pythonpath = ["src"]
-addopts = "--cov=src/devx --cov-report=term-missing --cov-fail-under=100 -p no:devx_test_isolation"
-markers = [
-    "integration: marks tests as integration tests (not counted in coverage)",
-]
-
-[tool.coverage.run]
-# The test isolation pytest plugin (check_test_isolation.py) is loaded
-# by pytest before coverage instrumentation starts. Coverage config below
-# excludes decorator lines and pragma-marked code from the coverage check.
-branch = false
-
-[tool.coverage.report]
-exclude_lines = [
-    "pragma: no cover",
-    "if __name__ == .__main__",
-    # Click decorator lines are executed at import time, before coverage
-    "@click\\.command|@click\\.option|@click\\.argument",
-]
-
-[tool.ruff]
-target-version = "py312"
-line-length = 120
-
-[tool.ruff.lint]
-select = ["E", "F", "I", "W", "UP", "B", "C4", "SIM"]
-ignore = ["SIM117"]
-
-[tool.ruff.format]
-quote-style = "double"
-indent-style = "space"
-
-[tool.pyright]
-include = ["src"]
-pythonVersion = "3.12"
-venvPath = "."
-venv = ".venv"
-strict = ["src/devx/config.py", "src/devx/exceptions.py", "src/devx/i18n.py", "src/devx/api_clients.py", "src/devx/gitea_cli.py"]
-
-# ---------------------------------------------------------------------------
-# Change classification — determines which changes trigger a release
-# ---------------------------------------------------------------------------
-# The framework provides DEFAULT_INFRASTRUCTURE (CI workflows, tests, docs,
-# lint config, etc.) that applies to any Python project.  We only specify
-# what's different about devx.
-#
-# Rule priority (first match wins):
-#   1. user_facing_overrides (safety — highest priority)
-#   2. infrastructure_overrides (explicit per-file)
-# Project-specific devx configuration (read by devx.config)
-[tool.devx]
-task_prefix = "DEVX"
-vikunja_project_id = 8
-repo_owner = "oblachno-oss"
-repo_name = "devx"
-
-[tool.devx.check_agent_docs]
-skip_ref_prefixes = [
-    "src/myproject/",
-    "ansible/requirements.yml",
-]
-
-#   3. infrastructure (DEFAULT_INFRASTRUCTURE + project-specific patterns)
-#   4. Default: user-facing (safe)
-[tool.devx.classify]
-# use_defaults = true   # (default) merge with DEFAULT_INFRASTRUCTURE
-
-# Project-specific infrastructure paths (merged with defaults).
-# devx has no additional infrastructure paths — everything not in the
-# defaults is user-facing (src/devx/**, pyproject.toml, translations.json).
-infrastructure = []
-
-# Infrastructure overrides — files that would default to user-facing
-# but are actually infrastructure:
-# - __init__.py: only contains __version__ (set by release.py, not user code)
-#
-# NOTE: api_clients.py is NOT here — it's used by devx's CI modules
-# (auto_merge.py, release.py, pr_review.py, etc.) which consumer projects
-# call via `python -m devx.ci.*`. Changes to api_clients.py affect consumer
-# projects' CI behavior, so it IS user-facing.
-infrastructure_overrides = [
-    "src/devx/__init__.py",
-]
-
-# User-facing overrides — safety override for broad infrastructure patterns
-# devx workflow files (.gitea/**) are reference implementations that
-# downstream repos (grm, infra) copy from. Changes to them affect how
-# consumer projects run their CI, so they must trigger a release.
-user_facing_overrides = [
-    ".gitea/**",
-]
-
-# Tag patterns — additional categories for CI conditional execution
-# Orthogonal to release impact (user-facing vs infrastructure)
-[tool.devx.classify.tags]
-# No tags needed for devx itself — it has no ansible/ directory
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="90" height="20" role="img"
+  aria-label="python: 3.12">
+  <title>python: 3.12</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="90" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="52" height="20" fill="#555"/>
+    <rect x="52" width="38" height="20" fill="#007ec6"/>
+    <rect width="90" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="26" y="14">python</text>
+    <text x="71" y="14">3.12</text>
+  </g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="124" height="20" role="img"
+  aria-label="code quality: A">
+  <title>code quality: A</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#fff" stop-opacity=".7"/>
+    <stop offset=".1" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset=".9" stop-color="#000" stop-opacity=".3"/>
+    <stop offset="1" stop-color="#bbb" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="124" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="94" height="20" fill="#555"/>
+    <rect x="94" width="30" height="20" fill="#4c1"/>
+    <rect width="124" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
+    <text x="47" y="14">code quality</text>
+    <text x="109" y="14">A</text>
+  </g>
+</svg>
@@ -1,3 +0,0 @@
-"""devx — reusable development and CI/CD tools for oblachno-oss projects."""
-
-__version__ = "0.48.1"
@@ -1,503 +0,0 @@
-"""Reusable HTTP API clients for Gitea and Vikunja."""
-
-from __future__ import annotations
-
-import json
-import logging
-from typing import Any
-
-import requests
-from tenacity import (
-    before_sleep_log,
-    retry,
-    retry_if_exception_type,
-    stop_after_attempt,
-    wait_exponential,
-)
-
-from devx.config import DEFAULT_TIMEOUT, MAX_RETRIES, RETRY_BACKOFF_BASE, RETRY_STATUS_CODES
-from devx.exceptions import APIError
-
-logger = logging.getLogger("devx")
-
-
-def _parse_error(e: requests.HTTPError) -> tuple[int, str]:
-    """Extract status code and message from an HTTPError response."""
-    response = getattr(e, "response", None)
-    status = response.status_code if response is not None else 0
-    try:
-        body: dict[str, Any] = response.json() if response is not None else {}
-        message: str = body.get("message", str(e))
-    except (json.JSONDecodeError, ValueError, AttributeError):
-        message = str(e)
-    return status, message
-
-
-class _TransientHTTPError(requests.HTTPError):
-    """HTTP error with a retryable status code (wrapped for tenacity)."""
-
-
-class _RetryableRequestError(Exception):
-    """Connection/timeout error wrapped for tenacity retry."""
-
-
-def _execute_request(
-    session: requests.Session,
-    method: str,
-    url: str,
-    **kwargs: Any,
-) -> requests.Response:
-    """Execute a single HTTP request, wrapping transient errors for tenacity.
-
-    Non-retryable HTTP errors (4xx except 429) raise :class:`APIError` directly.
-    Retryable errors (429, 5xx, connection, timeout) raise exceptions that
-    tenacity will retry.
-    """
-    try:
-        response = session.request(method, url, timeout=DEFAULT_TIMEOUT, **kwargs)
-        response.raise_for_status()
-        return response
-    except requests.HTTPError as e:
-        status, message = _parse_error(e)
-        if status in RETRY_STATUS_CODES:
-            # Wrap in _TransientHTTPError so tenacity retries it
-            raise _TransientHTTPError(message, response=e.response) from e
-        raise APIError(status, message) from e
-    except (requests.ConnectionError, requests.Timeout) as e:
-        raise _RetryableRequestError(str(e)) from e
-
-
-# Tenacity retry decorator shared by both clients.
-# Retries on transient HTTP errors (429, 5xx) and connection/timeout errors.
-_retry_decorator = retry(
-    stop=stop_after_attempt(MAX_RETRIES),
-    wait=wait_exponential(multiplier=RETRY_BACKOFF_BASE, min=RETRY_BACKOFF_BASE, max=RETRY_BACKOFF_BASE**MAX_RETRIES),
-    retry=retry_if_exception_type((_TransientHTTPError, _RetryableRequestError)),
-    before_sleep=before_sleep_log(logger, logging.WARNING),
-    reraise=True,
-)
-
-
-def _request_with_retry(
-    session: requests.Session,
-    url: str,
-    method: str,
-    **kwargs: Any,
-) -> requests.Response:
-    """Execute an HTTP request with tenacity-managed retry logic.
-
-    On exhaustion, the last exception is translated to :class:`APIError`.
-    """
-    try:
-        return _retry_decorator(_execute_request)(session, method, url, **kwargs)
-    except _TransientHTTPError as e:
-        response = getattr(e, "response", None)
-        status = response.status_code if response is not None else 0
-        raise APIError(status, str(e)) from e
-    except _RetryableRequestError as e:
-        raise APIError(0, str(e)) from e
-
-
-class GiteaClient:
-    """Low-level Gitea REST API client with connection pooling."""
-
-    def __init__(self, base_url: str, token: str, owner: str, repo: str) -> None:
-        self._base_url = base_url.rstrip("/")
-        self._owner = owner
-        self._repo = repo
-        self._session = requests.Session()
-        self._session.headers.update(
-            {
-                "Authorization": f"token {token}",
-                "Content-Type": "application/json",
-            }
-        )
-
-    def _url(self, path: str) -> str:
-        return f"{self._base_url}/repos/{self._owner}/{self._repo}{path}"
-
-    def _request(self, method: str, path: str, **kwargs: Any) -> requests.Response:
-        return _request_with_retry(self._session, self._url(path), method, **kwargs)
-
-    # -- repo settings --
-
-    def update_repo_settings(self, settings: dict[str, Any]) -> dict[str, Any]:
-        """Update repository settings (e.g. auto-delete branch after merge)."""
-        r = self._request("PATCH", "", json=settings)
-        return r.json()
-
-    # -- branch protection --
-
-    def list_branch_protections(self) -> list[dict[str, Any]]:
-        r = self._request("GET", "/branch_protections")
-        return r.json()
-
-    def create_branch_protection(self, config: dict[str, Any]) -> dict[str, Any]:
-        r = self._request("POST", "/branch_protections", json=config)
-        return r.json()
-
-    def update_branch_protection(self, branch: str, config: dict[str, Any]) -> dict[str, Any]:
-        r = self._request("PATCH", f"/branch_protections/{branch}", json=config)
-        return r.json()
-
-    def ensure_branch_protection(self, branch: str, config: dict[str, Any]) -> dict[str, Any]:
-        """Idempotent: create or update branch protection for the given branch."""
-        existing = self.list_branch_protections()
-        for p in existing:
-            if p.get("branch_name") == branch:
-                update_config = {k: v for k, v in config.items() if k != "branch_name"}
-                return self.update_branch_protection(branch, update_config)
-        return self.create_branch_protection(config)
-
-    # -- labels --
-
-    def list_labels(self) -> list[dict[str, Any]]:
-        r = self._request("GET", "/labels")
-        return r.json()
-
-    def create_label(self, name: str, color: str, description: str = "") -> dict[str, Any]:
-        r = self._request(
-            "POST",
-            "/labels",
-            json={"name": name, "color": color, "description": description},
-        )
-        return r.json()
-
-    def ensure_label(self, name: str, color: str, description: str = "") -> dict[str, Any] | None:
-        """Idempotent: create label if it doesn't already exist."""
-        labels = self.list_labels()
-        for label in labels:
-            if label["name"] == name:
-                return None
-        return self.create_label(name, color, description)
-
-    def create_issue(self, title: str, body: str = "", labels: list[int] | None = None) -> dict[str, Any]:
-        """Create a new issue in the repository.
-
-        Args:
-            labels: List of label IDs (integers, not names).
-        """
-        payload: dict[str, Any] = {"title": title, "body": body}
-        if labels:
-            payload["labels"] = labels
-        r = self._request("POST", "/issues", json=payload)
-        return r.json()
-
-    # -- pulls / releases --
-
-    def get_pr_labels(self, pr_number: str | int) -> list[dict[str, Any]]:
-        """Fetch labels currently attached to a pull request."""
-        r = self._request("GET", f"/issues/{pr_number}/labels")
-        return r.json()
-
-    def merge_pr(self, pr_number: str | int, merge_title: str) -> None:
-        payload = {"Do": "squash", "MergeTitleField": merge_title}
-        self._request("POST", f"/pulls/{pr_number}/merge", json=payload)
-
-    def update_pr_branch(self, pr_number: str | int, style: str = "rebase") -> None:
-        """Update PR head branch by merging/rebasing the base branch into it.
-
-        Uses the Gitea API ``POST /pulls/{index}/update?style=rebase`` endpoint.
-        This rebases the PR's head branch onto the latest base branch server-side,
-        triggering a ``pull_request synchronize`` event that starts a new CI run.
-
-        Args:
-            pr_number: PR number.
-            style: Update method — ``"rebase"`` (default) or ``"merge"``.
-        """
-        self._request("POST", f"/pulls/{pr_number}/update", params={"style": style})
-
-    def get_commit_status(self, sha: str) -> list[dict[str, Any]]:
-        """Fetch all status check contexts reported for a commit.
-
-        Uses the combined status endpoint (/commits/{sha}/status) which
-        returns one entry per context (the latest), deduplicated server-side.
-        The plural endpoint (/commits/{sha}/statuses) returns every historical
-        entry including stale "pending" ones that never got updated.
-        """
-        r = self._request("GET", f"/commits/{sha}/status")
-        data = r.json()
-        return data.get("statuses", [])
-
-    def get_pr(self, pr_number: str | int) -> dict[str, Any]:
-        """Fetch pull request details including mergeable state."""
-        r = self._request("GET", f"/pulls/{pr_number}")
-        return r.json()
-
-    def update_pr(self, pr_number: str | int, fields: dict[str, Any]) -> dict[str, Any]:
-        """Update a pull request (e.g. title, body, state).
-
-        Args:
-            pr_number: PR number.
-            fields: Dict of fields to update (e.g. {"title": "new title"}).
-        """
-        r = self._request("PATCH", f"/pulls/{pr_number}", json=fields)
-        return r.json()
-
-    def create_pr(self, title: str, head: str, base: str = "master", body: str = "") -> dict[str, Any]:
-        """Create a pull request and return the PR dict.
-
-        Args:
-            title: PR title.
-            head: Head branch name.
-            base: Base branch name (default: master).
-            body: PR description (markdown).
-        """
-        payload: dict[str, Any] = {"title": title, "head": head, "base": base}
-        if body:
-            payload["body"] = body
-        r = self._request("POST", "/pulls", json=payload)
-        return r.json()
-
-    def list_prs(self, state: str = "all", **params: Any) -> list[dict[str, Any]]:
-        """List pull requests, optionally filtered by state.
-
-        Args:
-            state: ``open``, ``closed``, ``all`` (default).
-            **params: Additional query params (e.g. ``q="keyword"`` for title search).
-        """
-        params.setdefault("state", state)
-        r = self._request("GET", "/pulls", params=params)
-        return r.json()
-
-    def get_pr_files(self, pr_number: str | int) -> list[dict[str, Any]]:
-        """Fetch the list of files changed in a pull request."""
-        r = self._request("GET", f"/pulls/{pr_number}/files")
-        return r.json()
-
-    def add_pr_label(self, pr_number: str | int, label_names: list[str]) -> None:
-        """Attach labels to a PR/issue by name.
-
-        Args:
-            pr_number: PR or issue number.
-            label_names: List of label names to attach.
-        """
-        self._request("POST", f"/issues/{pr_number}/labels", json={"labels": label_names})
-
-    def get_pr_label_names(self, pr_number: str | int) -> list[str]:
-        """Return label names currently attached to a PR/issue."""
-        r = self._request("GET", f"/issues/{pr_number}/labels")
-        return [label.get("name", "") for label in r.json()]
-
-    def get_pr_commits(self, pr_number: str | int) -> list[dict[str, Any]]:
-        """Fetch the commits included in a pull request."""
-        r = self._request("GET", f"/pulls/{pr_number}/commits")
-        return r.json()
-
-    def get_pr_reviews(self, pr_number: str | int) -> list[dict[str, Any]]:
-        """Fetch reviews posted on a pull request."""
-        r = self._request("GET", f"/pulls/{pr_number}/reviews")
-        return r.json()
-
-    def create_review(
-        self,
-        pr_number: str | int,
-        event: str = "COMMENT",
-        body: str = "",
-        comments: list[dict[str, Any]] | None = None,
-    ) -> dict[str, Any]:
-        """Post a review on a pull request.
-
-        Args:
-            event: ``APPROVED``, ``REQUEST_CHANGES``, or ``COMMENT``.
-            body: Top-level review body text.
-            comments: Line-level comments with ``path``, ``body``,
-                      ``new_position`` (and optionally ``old_position``).
-        """
-        # Map common event names to Gitea API values
-        event_map = {"APPROVE": "APPROVED", "REQUEST_CHANGES": "REQUEST_CHANGES", "COMMENT": "COMMENT"}
-        gitea_event = event_map.get(event, event)
-        payload: dict[str, Any] = {"event": gitea_event, "body": body}
-        if comments:
-            payload["comments"] = comments
-        r = self._request("POST", f"/pulls/{pr_number}/reviews", json=payload)
-        return r.json()
-
-    def create_release(
-        self,
-        tag: str,
-        name: str = "",
-        body: str = "",
-        draft: bool = False,
-        prerelease: bool = False,
-    ) -> dict[str, Any]:
-        payload = {
-            "tag_name": tag,
-            "name": name or tag,
-            "body": body,
-            "draft": draft,
-            "prerelease": prerelease,
-        }
-        r = self._request("POST", "/releases", json=payload)
-        return r.json()
-
-    def get_release_by_tag(self, tag: str) -> dict[str, Any] | None:
-        """Fetch a release by its tag name. Returns None if not found."""
-        try:
-            r = self._request("GET", f"/releases/tags/{tag}")
-            return r.json()
-        except APIError:
-            return None
-
-    def create_release_idempotent(
-        self,
-        tag: str,
-        name: str = "",
-        body: str = "",
-        draft: bool = False,
-        prerelease: bool = False,
-    ) -> dict[str, Any]:
-        """Create a release, or return the existing one if it already exists.
-
-        This is idempotent — safe to call multiple times for the same tag.
-        """
-        existing = self.get_release_by_tag(tag)
-        if existing:
-            logger.info("Release for tag %s already exists (ID %s), skipping creation.", tag, existing.get("id"))
-            return existing
-        return self.create_release(tag=tag, name=name, body=body, draft=draft, prerelease=prerelease)
-
-    # -- actions (CI/CD) --
-
-    def list_action_runs(self, **params: Any) -> dict[str, Any]:
-        """List workflow runs for the repository.
-
-        Returns the raw API response dict (includes ``workflow_runs`` and
-        ``total_count`` keys per Gitea API).
-        """
-        r = self._request("GET", "/actions/runs", params=params)
-        return r.json()
-
-    def get_action_run_jobs(self, run_id: str | int) -> list[dict[str, Any]]:
-        """List jobs for a specific workflow run."""
-        r = self._request("GET", f"/actions/runs/{run_id}/jobs")
-        data = r.json()
-        return data.get("jobs", [])
-
-    def get_action_job_logs(self, job_id: str | int) -> str:
-        """Fetch logs for a specific CI job.
-
-        Returns the raw log text. Raises APIError if logs are unavailable.
-        """
-        r = self._request("GET", f"/actions/jobs/{job_id}/logs")
-        return r.text
-
-    # -- actions variables (repo-level) --
-
-    def get_repo_variable(self, name: str) -> str | None:
-        """Read a Gitea Actions repository variable.
-
-        Returns the variable value, or ``None`` if the variable is not set.
-        Raises :class:`APIError` on other HTTP errors.
-        """
-        try:
-            r = self._request("GET", f"/actions/variables/{name}")
-            return r.json().get("value")
-        except APIError as e:
-            if e.status == 404:
-                return None
-            raise
-
-    def set_repo_variable(self, name: str, value: str) -> None:
-        """Create or update a Gitea Actions repository variable (idempotent).
-
-        Tries PUT first (update); if the variable doesn't exist (404),
-        creates it via POST. Gitea 1.26.x does not support PATCH for
-        action variables.
-        """
-        try:
-            self._request("PUT", f"/actions/variables/{name}", json={"value": value})
-        except APIError as e:
-            if e.status != 404:
-                raise
-            self._request("POST", f"/actions/variables/{name}", json={"value": value})
-
-
-class VikunjaClient:
-    """Low-level Vikunja REST API client with connection pooling."""
-
-    def __init__(self, base_url: str, token: str) -> None:
-        self._base_url = base_url.rstrip("/")
-        self._session = requests.Session()
-        self._session.headers.update({"Authorization": f"Bearer {token}"})
-
-    def _request(self, method: str, path: str, **kwargs: Any) -> requests.Response:
-        url = f"{self._base_url}{path}"
-        return _request_with_retry(self._session, url, method, **kwargs)
-
-    def list_tasks(self, **params: Any) -> list[dict[str, Any]]:
-        r = self._request("GET", "/tasks", params=params)
-        return r.json()
-
-    def get_task(self, task_id: int) -> dict[str, Any]:
-        """Fetch a single task by its numeric ID."""
-        r = self._request("GET", f"/tasks/{task_id}")
-        return r.json()
-
-    def list_project_tasks(self, project_id: int, **params: Any) -> list[dict[str, Any]]:
-        """List tasks in a specific project (more efficient than listing all tasks)."""
-        r = self._request("GET", f"/projects/{project_id}/tasks", params=params)
-        return r.json()
-
-    def find_task_by_identifier(self, project_id: int, identifier: str, per_page: int = 50) -> dict[str, Any] | None:
-        """Find a task by its identifier (e.g. ``DEVX-42``) in a project.
-
-        Paginates through all tasks in the project. Returns the task dict
-        or None if not found.
-        """
-        page = 1
-        while True:
-            tasks = self.list_project_tasks(project_id, page=page, per_page=per_page)
-            if not tasks:
-                break
-            for t in tasks:
-                if t.get("identifier") == identifier:
-                    return t
-            if len(tasks) < per_page:
-                break
-            page += 1
-        return None
-
-    def create_task(self, project_id: int, title: str, description: str = "") -> dict[str, Any]:
-        """Create a task in a project and return the created task dict.
-
-        Args:
-            project_id: Target Vikunja project ID.
-            title: Task title (required, non-empty).
-            description: Task description (HTML supported, optional).
-        """
-        r = self._request(
-            "PUT",
-            f"/projects/{project_id}/tasks",
-            json={"title": title, "description": description},
-        )
-        return r.json()
-
-    def post_comment(self, task_id: int, comment: str) -> None:
-        self._request("PUT", f"/tasks/{task_id}/comments", json={"comment": comment})
-
-    def list_comments(self, task_id: int) -> list[dict[str, Any]]:
-        """List all comments on a task."""
-        r = self._request("GET", f"/tasks/{task_id}/comments")
-        return r.json()
-
-    def update_task(self, task_id: int, **fields: Any) -> None:
-        """Update task fields via POST (full replacement semantics).
-
-        Warning: Vikunja's POST /tasks/{id} replaces the entire task body.
-        Unspecified fields are reset to their type defaults. Use
-        ``update_task_safe`` to preserve existing fields.
-        """
-        self._request("POST", f"/tasks/{task_id}", json=fields)
-
-    def update_task_safe(self, task_id: int, **fields: Any) -> dict[str, Any]:
-        """Safely update task fields using read-merge-write pattern.
-
-        Fetches the full task body, merges the provided fields on top,
-        and POSTs the complete body back. This prevents accidental
-        resets of done status, title, etc.
-        """
-        task = self.get_task(task_id)
-        task.update(fields)
-        r = self._request("POST", f"/tasks/{task_id}", json=task)
-        return r.json()
@@ -1,118 +0,0 @@
-"""Shared utilities for CI modules."""
-
-from __future__ import annotations
-
-import os
-import subprocess  # nosec B404
-
-import click
-
-from devx.config import TASK_ID_RE
-from devx.i18n import _
-
-
-def get_latest_tag() -> str:
-    """Get the latest git tag, or empty string if none exists."""
-    result = subprocess.run(  # nosec B603 B607
-        ["git", "describe", "--tags", "--abbrev=0"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        return ""
-    return result.stdout.strip()
-
-
-def run_cmd(
-    args: list[str],
-    check: bool = True,
-    capture: bool = True,
-) -> subprocess.CompletedProcess[str]:
-    """Run a command and return the completed process.
-
-    Args:
-        args: Command and arguments as a list.
-        check: If True, raise :class:`click.ClickException` on non-zero exit.
-        capture: If True, capture stdout/stderr. If False, inherit parent's.
-    """
-    result = subprocess.run(  # nosec B603
-        args,
-        capture_output=capture,
-        text=True,
-        check=False,
-    )
-    if check and result.returncode != 0:
-        raise click.ClickException(
-            _(
-                "Command failed ({cmd}): {stderr}",
-                cmd=" ".join(args),
-                stderr=result.stderr.strip() if result.stderr else result.stdout.strip(),
-            )
-        )
-    return result
-
-
-def extract_task_id(text: str) -> str:
-    """Extract the ``{PREFIX}-N`` task identifier from *text*.
-
-    Returns the matched string (e.g. ``DEVX-42``) or an empty string if
-    no task ID is found.
-    """
-    match = TASK_ID_RE.search(text)
-    return match.group(0) if match else ""
-
-
-def write_github_env(key: str, value: str) -> None:
-    """Append a key=value line to the ``$GITHUB_ENV`` file.
-
-    Multi-line values use the heredoc syntax required by Gitea Actions.
-    Raises :class:`click.ClickException` if ``GITHUB_ENV`` is not set.
-    """
-    gh_env = os.environ.get("GITHUB_ENV")
-    if not gh_env:
-        raise click.ClickException("GITHUB_ENV environment variable is not set")
-    with open(gh_env, "a", encoding="utf-8") as f:  # noqa: PTH123
-        if "\n" in value:
-            delimiter = "EOF"
-            f.write(f"{key}<<{delimiter}\n{value}\n{delimiter}\n")
-        else:
-            f.write(f"{key}={value}\n")
-
-
-def write_github_output(key: str, value: str) -> None:
-    """Append a key=value line to the ``$GITHUB_OUTPUT`` file.
-
-    Raises :class:`click.ClickException` if ``GITHUB_OUTPUT`` is not set.
-    """
-    gh_output = os.environ.get("GITHUB_OUTPUT")
-    if not gh_output:
-        raise click.ClickException("GITHUB_OUTPUT environment variable is not set")
-    with open(gh_output, "a", encoding="utf-8") as f:  # noqa: PTH123
-        f.write(f"{key}={value}\n")
-
-
-def lpt_distribute[T](items: list[T], weights: list[int], max_runners: int) -> list[list[T]]:
-    """Distribute *items* across *max_runners* using LPT scheduling.
-
-    Sorts items by weight (descending), then assigns each to the runner
-    with the least total weight. This produces a more balanced distribution
-    than naive round-robin when items have varying costs.
-
-    Args:
-        items: Items to distribute.
-        weights: Parallel list of integer weights (higher = heavier).
-        max_runners: Number of runner groups to create.
-
-    Returns:
-        A list of ``max_runners`` lists, each containing the items assigned
-        to that runner.
-    """
-    groups: list[list[T]] = [[] for _ in range(max_runners)]
-    loads = [0] * max_runners
-    indexed = sorted(enumerate(items), key=lambda x: (-weights[x[0]], x[0]))
-    for orig_idx, item in indexed:
-        min_runner = min(range(max_runners), key=lambda r: loads[r])
-        groups[min_runner].append(item)
-        loads[min_runner] += weights[orig_idx]
-    return groups
@@ -1,294 +0,0 @@
-#!/usr/bin/env python3
-"""Auto-merge PR when all CI checks pass.
-
-Runs as the final job in ci.yml. Reads the task ID from the branch name
-(e.g., ``DEVX-31-fix-foo`` → ``DEVX-31``), validates the PR title against
-the Vikunja task, and squash-merges with a conventional commit message
-prefixed by the task ID.
-
-PR title format:    ``{PREFIX}-N: <vikunja task title>``
-Merge commit format: ``{PREFIX}-N <conventional commit message>``
-
-The ``{PREFIX}`` is determined by ``DEVX_TASK_PREFIX`` (default: ``DEVX``).
-Each project sets its own prefix (e.g., ``GRM``, ``INFRA``).
-
-The conventional commit message is extracted from the PR commits.
-This allows the PR title to be a human-friendly Vikunja task title
-while the squashed commit follows conventional commits.
-
-Usage:
-  CI_GITEA_API_TOKEN=<token> VIKUNJA_TOKEN=<token> python3 -m devx.ci.auto_merge <branch> <pr_title> <repo> <pr_number>
-"""
-
-import re
-from pathlib import Path
-from typing import Any
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.api_clients import GiteaClient, VikunjaClient
-from devx.ci._shared import extract_task_id as _extract_task_id
-from devx.config import (
-    CONVENTIONAL_RE,
-    DEFAULT_PER_PAGE,
-    GITEA_API_URL,
-    TASK_PREFIX,
-    VIKUNJA_API_URL,
-    VIKUNJA_PROJECT_ID,
-)
-from devx.exceptions import APIError
-from devx.i18n import _
-from devx.tokens import get_ci_token, get_vikunja_token
-
-# Strip leading task ID prefix (e.g. "DEVX-12: " or "OBL-INFRA-364: ") from commit subjects.
-_TASK_ID_PREFIX_RE = re.compile(rf"^{TASK_PREFIX}-\d+:\s*")
-
-TASKID_FILE = ".taskid"  # Deprecated, kept for backward-compat warnings
-PR_TITLE_RE = re.compile(rf"^{TASK_PREFIX}-\d+:\s+.+")
-
-load_dotenv()
-
-
-def read_taskid(branch: str) -> str:
-    """Read task ID from branch name.
-
-    The branch name is the sole source of truth for the task ID
-    (e.g., ``DEVX-31-fix-foo`` → ``DEVX-31``).  Branches must include
-    the task ID prefix — there is no ``.taskid`` file fallback.
-
-    If a stale ``.taskid`` file exists and disagrees with the branch
-    name, a deprecation warning is printed advising its removal.
-    """
-    branch_task_id = extract_task_id(branch)
-    if branch_task_id:
-        # Warn about stale .taskid file if it exists and disagrees
-        path = Path(TASKID_FILE)
-        if path.exists():
-            file_task_id = path.read_text(encoding="utf-8").strip()
-            if file_task_id and file_task_id != branch_task_id:
-                click.echo(
-                    _(
-                        "WARNING: .taskid file ({file_id}) is deprecated and disagrees with branch name ({branch_id}). "
-                        "Delete .taskid from the repo — branch name is the sole source of truth.",
-                        file_id=file_task_id,
-                        branch_id=branch_task_id,
-                    )
-                )
-        return branch_task_id
-    return ""
-
-
-def extract_task_id(branch: str) -> str:
-    """Extract task identifier from branch name (delegates to shared utility)."""
-    return _extract_task_id(branch)
-
-
-def validate_pr_title(pr_title: str, task_id: str) -> None:
-    """Raise ClickException if PR title does not follow the required format.
-
-    Expected: ``{PREFIX}-N: <vikunja task title>``
-    """
-    if not PR_TITLE_RE.match(pr_title):
-        raise click.ClickException(
-            _(
-                "Oops! PR title must follow format '{prefix}-N: <task title>'.\n"
-                "  Expected: {task_id}: <task title>\n"
-                "  Got:      {pr_title}",
-                prefix=TASK_PREFIX,
-                task_id=task_id,
-                pr_title=pr_title,
-            )
-        )
-    if not pr_title.startswith(f"{task_id}:"):
-        raise click.ClickException(
-            _(
-                "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
-                task_id=task_id,
-                pr_title=pr_title,
-            )
-        )
-
-
-def get_vikunja_task_title(task_id: str) -> str:
-    """Fetch the Vikunja task title for the given DEVX-N identifier.
-
-    Raises ClickException if VIKUNJA_TOKEN is not set or the task is not found.
-    """
-    try:
-        token = get_vikunja_token()
-    except click.ClickException:
-        raise click.ClickException(
-            _("VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.")
-        ) from None
-    client = VikunjaClient(VIKUNJA_API_URL, token)
-    page = 1
-    while True:
-        tasks = client.list_project_tasks(VIKUNJA_PROJECT_ID, page=page, per_page=DEFAULT_PER_PAGE)
-        if not tasks:
-            break
-        matches = [t for t in tasks if t.get("identifier") == task_id]
-        if matches:
-            return str(matches[0].get("title", ""))
-        if len(tasks) < DEFAULT_PER_PAGE:
-            break
-        page += 1
-    raise click.ClickException(
-        _(
-            "Could not find Vikunja task {task_id} in project {project_id}. "
-            "Every PR must have a corresponding Vikunja task.",
-            task_id=task_id,
-            project_id=VIKUNJA_PROJECT_ID,
-        )
-    )
-
-
-def validate_pr_title_matches_vikunja(pr_title: str, task_id: str) -> None:
-    """Validate that PR title matches the Vikunja task title.
-
-    Raises ClickException if VIKUNJA_TOKEN is not set, the task is not found,
-    or the title doesn't match.
-    """
-    vikunja_title = get_vikunja_task_title(task_id)
-    expected = f"{task_id}: {vikunja_title}"
-    if pr_title != expected:
-        raise click.ClickException(
-            _(
-                "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
-                expected=expected,
-                pr_title=pr_title,
-            )
-        )
-
-
-def extract_conventional_msg(commits: list[dict[str, Any]]) -> str:
-    """Extract the conventional commit message from PR commits.
-
-    Picks the highest-priority conventional commit message from the PR.
-    Priority: feat > fix > refactor > docs > chore > other.
-    Falls back to the newest commit message if none match.
-    """
-    priority = {"feat": 5, "fix": 4, "refactor": 3, "docs": 2, "chore": 1, "ci": 1, "style": 1, "test": 1}
-    best_msg = ""
-    best_score = 0
-    for commit in reversed(commits):
-        commit_info = commit.get("commit", {})
-        message = str(commit_info.get("message", "") if isinstance(commit_info, dict) else "").split("\n")[0]
-        # Strip any leading task ID prefix (e.g. "OBL-INFRA-364: fix: ...") so
-        # conventional commit matching works on the remainder.
-        stripped = _TASK_ID_PREFIX_RE.sub("", message)
-        m = CONVENTIONAL_RE.match(stripped)
-        if m:
-            prefix = m.group(1).split("(")[0].strip()  # e.g. "feat" from "feat(scope)"
-            score = priority.get(prefix, 0)
-            if score > best_score:
-                best_score = score
-                best_msg = stripped
-    if best_msg:
-        return best_msg
-    # Fallback: use the newest commit's first line (strip task ID prefix if present)
-    if commits:
-        commit_info = commits[-1].get("commit", {})
-        raw = str(commit_info.get("message", "") if isinstance(commit_info, dict) else "").split("\n")[0]
-        return _TASK_ID_PREFIX_RE.sub("", raw)
-    return ""
-
-
-@click.command()
-@click.argument("branch")
-@click.argument("pr_title")
-@click.argument("repo")
-@click.argument("pr_number")
-def main(branch: str, pr_title: str, repo: str, pr_number: str) -> None:
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        raise click.ClickException(_("ERROR: CI_GITEA_TOKEN is not set.")) from None
-
-    # Validate PR number is an integer
-    try:
-        pr_num = int(pr_number)
-    except ValueError:
-        raise click.ClickException(_("PR number must be an integer, got: {pr_number}", pr_number=pr_number)) from None
-
-    # Validate repo format
-    if "/" not in repo:
-        raise click.ClickException(_("Repo must be in 'owner/name' format, got: {repo}", repo=repo))
-    owner, repo_name = repo.split("/", 1)
-    client = GiteaClient(GITEA_API_URL, token, owner, repo_name)
-
-    task_id = read_taskid(branch)
-    if not task_id:
-        raise click.ClickException(
-            _(
-                "Oops! No task ID found in branch name '{branch}'. "
-                "Branch names must include the task ID prefix (e.g., DEVX-31-fix-bug).",
-                branch=branch,
-            )
-        )
-    click.echo(_("Task ID: {task_id}", task_id=task_id))
-
-    validate_pr_title(pr_title, task_id)
-    validate_pr_title_matches_vikunja(pr_title, task_id)
-
-    # Build merge title: DEVX-N: <conventional commit message>
-    commits = client.get_pr_commits(pr_num)
-    conv_msg = extract_conventional_msg(commits)
-    if not conv_msg:
-        raise click.ClickException(_("Could not extract conventional commit message from PR commits."))
-    merge_title = f"{task_id}: {conv_msg}"
-
-    try:
-        client.merge_pr(pr_num, merge_title)
-    except APIError as e:
-        if e.status == 405 and "behind" in e.message.lower():
-            # Head branch is behind master. Auto-rebase via Gitea API.
-            # This triggers a new pull_request synchronize event → new CI run.
-            # The next auto-merge attempt will find the branch up-to-date and
-            # merge successfully. This is NOT an infinite loop: the rebase
-            # resolves the "behind" condition, so the next run merges.
-            # If another PR merges in between, the branch may fall behind
-            # again, but the process converges as PRs stop merging.
-            click.echo(
-                _(
-                    "Branch is behind master. Auto-rebasing via Gitea API...\n"
-                    "A new CI run will start automatically after the rebase.\n"
-                    "The next auto-merge attempt will merge this PR.",
-                )
-            )
-            try:
-                client.update_pr_branch(pr_num, style="rebase")
-            except APIError as rebase_err:
-                raise click.ClickException(
-                    _(
-                        "Auto-rebase failed with HTTP {status}: {message}\n"
-                        "Rebase manually:\n"
-                        "  git fetch origin master && git rebase origin/master && git push --force-with-lease\n"
-                        "Then re-add the ready-to-merge label.",
-                        status=rebase_err.status,
-                        message=rebase_err.message,
-                    )
-                ) from None
-            # Exit cleanly — the rebase triggers a new CI run that will retry.
-            return
-        else:
-            raise click.ClickException(
-                _(
-                    "Merge failed with HTTP {status}: {message}\n"
-                    "Please check the PR is ready and you have merge rights.",
-                    status=e.status,
-                    message=e.message,
-                )
-            ) from None
-
-    click.echo(
-        _(
-            "Nice! PR #{pr_number} squash-merged with title: {merge_title}",
-            pr_number=pr_num,
-            merge_title=merge_title,
-        )
-    )
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,314 +0,0 @@
-#!/usr/bin/env python3
-"""Pre-merge validation gate for auto-merge preconditions.
-
-Validates that a PR satisfies auto-merge requirements BEFORE expensive
-jobs (molecule tests, staging deploy) run.  This catches issues early:
-
-1. Branch name contains a task ID (e.g., ``DEVX-256-fix-foo``).
-2. PR title follows ``{PREFIX}-N: <title>`` format.
-3. PR title task ID matches the branch task ID.
-4. PR title matches the Vikunja task title (requires ``VIKUNJA_TOKEN``).
-5. Branch is not behind master (would trigger a rebase retry cycle).
-
-Exit code 0 = ready for auto-merge (preconditions satisfied).
-Exit code 1 = NOT ready — fix issues before pushing.
-
-Usage::
-
-  # CI (with VIKUNJA_TOKEN and CI_GITEA_API_TOKEN):
-  python3 -m devx.ci.check_auto_merge_ready \\
-      --branch "$HEAD_REF" \\
-      --pr-title "$PR_TITLE" \\
-      --repo "$REPOSITORY" \\
-      --pr-number "$PR_NUMBER"
-
-  # Local (pre-push hook, no PR yet — validates branch + title format only):
-  python3 -m devx.ci.check_auto_merge_ready --branch "$(git rev-parse --abbrev-ref HEAD)"
-
-  # Local (with PR number, fetches title from Gitea):
-  python3 -m devx.ci.check_auto_merge_ready --branch "$(git rev-parse --abbrev-ref HEAD)" \\
-      --repo owner/repo --pr-number 123
-
-If ``VIKUNJA_TOKEN`` is not set, the Vikunja title match check is
-skipped (with a warning) — this allows local pre-push hooks to run
-without CI secrets.  In CI, the token is always set and the check is
-mandatory.
-
-If ``CI_GITEA_API_TOKEN`` is not set and ``--pr-number`` is not provided, only
-branch-name and PR-title-format checks run (local mode).
-"""
-
-from __future__ import annotations
-
-import subprocess  # nosec B404
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.api_clients import GiteaClient, VikunjaClient
-from devx.ci.auto_merge import extract_task_id
-from devx.config import (
-    GITEA_API_URL,
-    VIKUNJA_API_URL,
-    VIKUNJA_PROJECT_ID,
-)
-from devx.exceptions import APIError
-from devx.i18n import _
-from devx.tokens import get_ci_token, get_vikunja_token
-
-load_dotenv()
-
-
-def is_branch_behind_master(branch: str) -> bool:
-    """Check if the local branch is behind origin/master.
-
-    Fetches origin first (best-effort) then compares commit counts.
-    Returns ``True`` if master has commits not in branch.
-    """
-    try:
-        subprocess.run(  # nosec B603, B607
-            ["git", "fetch", "origin", "master", "--quiet"],
-            check=False,
-            capture_output=True,
-            timeout=30,
-        )
-        result = subprocess.run(  # nosec B603, B607
-            ["git", "rev-list", "--count", f"origin/master..{branch}"],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=10,
-        )
-        if result.returncode != 0:
-            return False  # Can't determine — don't block
-        result = subprocess.run(  # nosec B603, B607
-            ["git", "rev-list", "--count", f"{branch}..origin/master"],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=10,
-        )
-        if result.returncode != 0:
-            return False
-        behind = int(result.stdout.strip() or "0")
-    except (subprocess.TimeoutExpired, FileNotFoundError, ValueError):
-        return False  # Don't block on git errors
-    return behind > 0
-
-
-def get_pr_title_from_gitea(repo: str, pr_number: int) -> str | None:
-    """Fetch the PR title from the Gitea API.
-
-    Returns ``None`` if no token is set or the PR cannot be fetched.
-    """
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        return None
-    if "/" not in repo:
-        return None
-    owner, repo_name = repo.split("/", 1)
-    client = GiteaClient(GITEA_API_URL, token, owner, repo_name)
-    try:
-        pr = client.get_pr(pr_number)
-        return str(pr.get("title", ""))
-    except APIError:
-        return None
-
-
-def get_vikunja_title_optional(task_id: str) -> str | None:
-    """Fetch the Vikunja task title, returning None if token is not set.
-
-    Unlike :func:`devx.ci.auto_merge.get_vikunja_task_title`, this does NOT
-    raise when ``VIKUNJA_TOKEN`` is missing — it returns ``None`` so the
-    caller can skip the check in local mode.
-    """
-    try:
-        token = get_vikunja_token()
-    except click.ClickException:
-        return None
-    client = VikunjaClient(VIKUNJA_API_URL, token)
-    from devx.config import DEFAULT_PER_PAGE
-
-    page = 1
-    while True:
-        tasks = client.list_project_tasks(VIKUNJA_PROJECT_ID, page=page, per_page=DEFAULT_PER_PAGE)
-        if not tasks:
-            break
-        matches = [t for t in tasks if t.get("identifier") == task_id]
-        if matches:
-            return str(matches[0].get("title", ""))
-        if len(tasks) < DEFAULT_PER_PAGE:
-            break
-        page += 1
-    return None
-
-
-@click.command()
-@click.option("--branch", required=True, help=_("Branch name (e.g., DEVX-256-fix-foo)"))
-@click.option("--pr-title", default=None, help=_("PR title (auto-fetched if --pr-number given)"))
-@click.option("--repo", default=None, help=_("Repository in owner/name format"))
-@click.option("--pr-number", type=int, default=None, help=_("PR number (to fetch title from Gitea)"))
-@click.option("--skip-vikunja", is_flag=True, help=_("Skip Vikunja title match check"))
-@click.option("--skip-behind-check", is_flag=True, help=_("Skip branch-behind-master check"))
-def cli(
-    branch: str,
-    pr_title: str | None,
-    repo: str | None,
-    pr_number: int | None,
-    skip_vikunja: bool,
-    skip_behind_check: bool,
-) -> None:
-    """Validate auto-merge preconditions before expensive CI jobs."""
-    import re
-
-    from devx.config import TASK_PREFIX
-
-    pr_title_re = re.compile(rf"^{TASK_PREFIX}-\d+:\s+.+")  # noqa: PLW1503
-
-    errors: list[str] = []
-
-    # 1. Branch task ID
-    task_id = extract_task_id(branch)
-    if not task_id:
-        errors.append(
-            _(
-                "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
-                branch=branch,
-                prefix=TASK_PREFIX,
-            ),
-        )
-        # Can't continue — no task ID to validate against
-        for e in errors:
-            click.echo(f"ERROR: {e}", err=True)
-        raise click.ClickException(_("Branch name must contain a task ID."))
-
-    click.echo(f"[pre-merge-check] Task ID: {task_id}")
-
-    # 2. Resolve PR title
-    if pr_title is None and pr_number is not None and repo is not None:
-        pr_title = get_pr_title_from_gitea(repo, pr_number)
-        if pr_title:
-            click.echo(f"[pre-merge-check] PR title (from Gitea): {pr_title}")
-
-    if pr_title is None:
-        # Local mode without PR — only validate branch name
-        if pr_number is not None:
-            raise click.ClickException(
-                _("Could not fetch PR title from Gitea (CI_GITEA_TOKEN not set or PR not found).")
-            )
-        click.echo("[pre-merge-check] No PR title provided — running branch-name-only check (local mode).")
-        click.echo("[pre-merge-check] Branch name OK. Push to create PR, then CI will validate the title.")
-        return
-
-    # 3. PR title format
-    if not pr_title_re.match(pr_title):
-        errors.append(
-            _(
-                "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
-                prefix=TASK_PREFIX,
-                title=pr_title,
-            ),
-        )
-
-    # 4. PR title task ID matches branch task ID
-    if not pr_title.startswith(f"{task_id}:"):
-        errors.append(
-            _(
-                "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
-                task_id=task_id,
-                title=pr_title,
-            ),
-        )
-
-    # 5. Vikunja task title match (skip if no token or --skip-vikunja)
-    if not skip_vikunja:
-        vikunja_title = get_vikunja_title_optional(task_id)
-        if vikunja_title is None:
-            try:
-                get_vikunja_token()
-                token_set = True
-            except click.ClickException:
-                token_set = False
-            if token_set:
-                errors.append(
-                    _(
-                        "Could not find Vikunja task {task_id} in project {project_id}.",
-                        task_id=task_id,
-                        project_id=VIKUNJA_PROJECT_ID,
-                    ),
-                )
-            else:
-                click.echo("[pre-merge-check] WARNING: VIKUNJA_TOKEN not set — skipping Vikunja title match check.")
-        else:
-            # Defensive check: warn if the Vikunja task title already includes
-            # the task ID prefix. The expected PR title is
-            # f"{task_id}: {vikunja_title}" — if vikunja_title already starts
-            # with "{task_id}:", the PR title will have a double prefix.
-            if vikunja_title.startswith(f"{task_id}:"):
-                errors.append(
-                    _(
-                        "Vikunja task title '{title}' starts with '{prefix}:'. "
-                        "The task title should NOT include the '{prefix}' prefix — "
-                        "it is automatically added to the PR title. "
-                        "Update the Vikunja task title to remove the prefix.",
-                        title=vikunja_title,
-                        prefix=task_id,
-                    ),
-                )
-            else:
-                expected = f"{task_id}: {vikunja_title}"
-                if pr_title != expected:
-                    errors.append(
-                        _(
-                            "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
-                            expected=expected,
-                            title=pr_title,
-                        ),
-                    )
-                else:
-                    click.echo(f"[pre-merge-check] Vikunja title match OK: {expected}")
-
-    # 6. Branch behind master (skip if --skip-behind-check)
-    if not skip_behind_check:
-        if is_branch_behind_master(branch):
-            errors.append(
-                _("Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master")
-            )
-        else:
-            click.echo("[pre-merge-check] Branch is up-to-date with origin/master.")
-
-    if errors:
-        click.echo("", err=True)
-        click.echo("=" * 60, err=True)
-        click.echo("Pre-merge validation FAILED — fix these before pushing:", err=True)
-        click.echo("=" * 60, err=True)
-        for e in errors:
-            click.echo(f"  - {e}", err=True)
-
-        # Remediation hints for the most common failure: PR title format
-        title_errors = [
-            e for e in errors if "PR title must follow format" in str(e) or "PR title task ID mismatch" in str(e)
-        ]
-        if title_errors and pr_number is not None and repo is not None:
-            click.echo("", err=True)
-            click.echo("REMEDIATION:", err=True)
-            click.echo(
-                _(
-                    "  Fix the PR title with:\n"
-                    "    python3 -m devx.ci.fix_pr_title --repo {repo} --pr-number {pr}\n"
-                    "  Or manually set the PR title to: '{expected}'",
-                    repo=repo,
-                    pr=pr_number,
-                    expected=f"{task_id}: <Vikunja task title>",
-                ),
-                err=True,
-            )
-
-        raise click.ClickException(_("Pre-merge validation failed."))
-
-    click.echo("[pre-merge-check] All auto-merge preconditions satisfied.")
-
-
-if __name__ == "__main__":  # pragma: no cover
-    cli()  # pragma: no cover
@@ -1,227 +0,0 @@
-#!/usr/bin/env python3
-"""Check translation files for gaps, dead keys, and missing languages.
-
-Validates translation files against the Python source code that uses them.
-By default, checks ``src/devx/translations.json`` against keys used in
-``src/devx/**/*.py``. Additional translation sets can be checked by
-passing ``--translations`` flags (each pointing to a JSON file; the
-source directory is inferred as the parent of the translations file).
-
-Checks performed (all fail with exit code 1 on error):
- **Missing keys**: a ``_()`` call in code has no entry in the corresponding
-  translations file.
- **Dead keys**: a key in a translations file is not used in any code.
- **Missing languages**: a key exists but is missing one of the 6 supported
-  languages (en, bg, de, ru, zh, pl). This is an error — all supported languages
-  must have translations for every key.
-
-Usage::
-
-    python3 -m devx.ci.check_translations
-    python3 -m devx.ci.check_translations --translations path/to/translations.json
-"""
-
-from __future__ import annotations
-
-import ast
-import json
-import sys
-from dataclasses import dataclass, field
-from pathlib import Path
-
-import click
-
-REPO_ROOT = Path.cwd()
-
-SUPPORTED_LANGS = ("en", "bg", "de", "ru", "zh", "pl")
-
-# Default translation set: look for translations.json in the current repo
-DEFAULT_TRANS_FILE = REPO_ROOT / "src" / "devx" / "translations.json"
-DEFAULT_SRC_DIR = REPO_ROOT / "src" / "devx"
-
-# Functions that wrap _() and receive a translation key as first arg.
-# Their string-literal arguments should be treated as translation keys.
-_I18N_WRAPPERS = {"_handle_errors"}
-
-# Known dynamic keys used via _(variable) that can't be detected by AST.
-# These are status strings set as variable values and passed to _().
-DYNAMIC_KEYS = {"completed", "pending", "in_progress", "failed", "active", "inactive", "unknown"}
-
-
-@dataclass
-class TranslationCheckResult:
-    """Result of a translation check for one translation set."""
-
-    name: str
-    src_dir: Path
-    trans_file: Path
-    used_keys: set[str] = field(default_factory=set)
-    defined_keys: set[str] = field(default_factory=set)
-    missing_keys: set[str] = field(default_factory=set)
-    dead_keys: set[str] = field(default_factory=set)
-    missing_langs: dict[str, list[str]] = field(default_factory=dict)
-    errors: list[str] = field(default_factory=list)
-    warnings: list[str] = field(default_factory=list)
-
-
-def extract_keys(filepath: Path) -> set[str]:
-    """Extract translation keys from a Python file using AST.
-
-    Detects:
-    - ``_("key")`` calls with string-literal first argument
-    - ``_handle_errors("key")`` and other wrapper calls (see ``_I18N_WRAPPERS``)
-    """
-    try:
-        tree = ast.parse(filepath.read_text(encoding="utf-8"), filename=str(filepath))
-    except SyntaxError:
-        return set()
-    keys: set[str] = set()
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Call):
-            func = node.func
-            if (
-                isinstance(func, ast.Name)
-                and func.id in ("_", *_I18N_WRAPPERS)
-                and node.args
-                and isinstance(node.args[0], ast.Constant)
-                and isinstance(node.args[0].value, str)
-            ):
-                keys.add(node.args[0].value)
-    return keys
-
-
-def collect_keys(src_dir: Path) -> set[str]:
-    """Collect all translation keys from .py files in a directory tree.
-
-    Also includes known dynamic keys (see ``DYNAMIC_KEYS``) that are used
-    via ``_(variable)`` and can't be detected by AST scanning.
-    """
-    keys: set[str] = set()
-    for pyfile in src_dir.rglob("*.py"):
-        if pyfile.name == "i18n.py":
-            continue
-        keys |= extract_keys(pyfile)
-    # Dynamic keys are common status strings used via _(variable) that
-    # can't be detected by AST scanning. Include them for all projects.
-    keys |= DYNAMIC_KEYS
-    return keys
-
-
-def check_translation_set(name: str, src_dir: Path, trans_file: Path) -> TranslationCheckResult:
-    """Check one translation set for gaps and dead keys."""
-    result = TranslationCheckResult(name=name, src_dir=src_dir, trans_file=trans_file)
-
-    # Collect used keys from source code
-    result.used_keys = collect_keys(src_dir)
-
-    # Load defined keys from translations file
-    if not trans_file.exists():
-        result.errors.append(f"Translations file not found: {trans_file}")
-        return result
-
-    translations = json.loads(trans_file.read_text(encoding="utf-8"))
-    result.defined_keys = set(translations.keys())
-
-    # Check for missing keys (used in code but not in translations)
-    result.missing_keys = result.used_keys - result.defined_keys
-    for key in sorted(result.missing_keys):
-        result.errors.append(f"Missing key in {name}: {key!r}")
-
-    # Check for dead keys (in translations but not used in code)
-    result.dead_keys = result.defined_keys - result.used_keys
-    for key in sorted(result.dead_keys):
-        result.errors.append(f"Dead key in {name}: {key!r}")
-
-    # Check for missing languages — this is an error, not a warning.
-    # All supported languages must have translations for every key.
-    for key, langs in translations.items():
-        missing = [lang for lang in SUPPORTED_LANGS if lang not in langs]
-        if missing:
-            result.missing_langs[key] = missing
-            result.errors.append(f"Missing languages {missing} for key {key!r} in {name}")
-
-    return result
-
-
-def print_result(result: TranslationCheckResult) -> None:
-    """Print check results in a human-readable format."""
-    click.echo(f"\n=== {result.name} ===")
-    click.echo(f"  Source dir:     {result.src_dir}")
-    click.echo(f"  Translations:   {result.trans_file}")
-    click.echo(f"  Used keys:      {len(result.used_keys)}")
-    click.echo(f"  Defined keys:   {len(result.defined_keys)}")
-    click.echo(f"  Missing keys:   {len(result.missing_keys)}")
-    click.echo(f"  Dead keys:      {len(result.dead_keys)}")
-    click.echo(f"  Missing langs:  {len(result.missing_langs)} keys")
-
-    for err in result.errors:
-        click.echo(f"  ERROR: {err}", err=True)
-    for warn in result.warnings:
-        click.echo(f"  WARN:  {warn}", err=True)
-
-    if not result.errors and not result.warnings:
-        click.echo("  All good!")
-
-
-@click.command()
-@click.option(
-    "--translations",
-    "translations",
-    multiple=True,
-    type=click.Path(exists=False, path_type=Path),
-    help="Path to a translations JSON file to check (can be repeated). Auto-detects by default.",
-)
-@click.option(
-    "--source-dir",
-    default=None,
-    help="Source directory to scan for _() calls (default: auto-detect).",
-)
-def main(translations: tuple[Path, ...], source_dir: str | None) -> None:
-    """Check translation files for gaps, dead keys, and missing languages."""
-    results: list[TranslationCheckResult] = []
-    if not translations:
-        # Auto-detect translations file in the current repo
-        root = Path.cwd()
-        # Try common locations
-        candidates = [
-            root / "src" / "devx" / "translations.json",
-            root / "src" / "grm" / "translations.json",
-        ]
-        # Also search for any translations.json in src/
-        for match in root.glob("src/*/translations.json"):
-            candidates.append(match)
-
-        found = False
-        for candidate in candidates:
-            if candidate.exists():
-                src_dir = Path(source_dir) if source_dir else candidate.parent
-                results.append(check_translation_set(candidate.parent.name, src_dir, candidate))
-                found = True
-                break
-
-        if not found:
-            # No translations file found — this repo doesn't use i18n
-            click.echo("PASS: No translations file found — skipping (repo does not use i18n).")
-            return
-    else:
-        for trans_file in translations:
-            # Infer source directory as the parent of the translations file
-            src_dir = Path(source_dir) if source_dir else trans_file.parent
-            name = trans_file.parent.name
-            results.append(check_translation_set(name, src_dir, trans_file))
-
-    has_errors = False
-    for result in results:
-        print_result(result)
-        if result.errors:
-            has_errors = True
-
-    click.echo()
-    if has_errors:
-        click.echo("FAIL: Translation check found errors.", err=True)
-        sys.exit(1)
-    click.echo("PASS: All translations are complete and up to date.")
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,734 +0,0 @@
-#!/usr/bin/env python3
-"""Classify git changes as user-facing or infrastructure.
-
-Determines whether changes between two git refs (e.g., last tag and HEAD)
-affect the published package (user-facing) or only the CI/CD infrastructure
-(workflow-only).  This is used by:
-
- **release.py** — skips release when only infrastructure files changed
- **CI workflow** — skips molecule tests and release dry-run when only
-  infrastructure files changed
-
-== Design Philosophy ==
-
-**Safe-by-default**: Any file that doesn't match a rule defaults to
-user-facing.  This prevents new file types from accidentally skipping
-releases — a critical safety property.  When in doubt, release.
-
-**Framework-provided defaults**: The framework ships with
-``DEFAULT_INFRASTRUCTURE`` — a curated list of paths that are
-infrastructure for ANY Python project (CI workflows, tests, docs,
-lint config, etc.).  Projects inherit these automatically and only
-need to specify what's *different* about their project.
-
-**Config-driven**: Classification rules are read from ``[tool.devx.classify]``
-in ``pyproject.toml``.  No project needs to modify the framework code.
-Each project declares its own paths; the framework handles the logic.
-
-**Layered rules** (evaluated in priority order):
-
-  1. **User-facing overrides** (highest priority — safety override)
-     Files that match infrastructure patterns but MUST be treated as
-     user-facing.  Use this when an infrastructure pattern is too broad.
-
-  2. **Infrastructure overrides**
-     Files that would default to user-facing but are actually
-     infrastructure (e.g., ``src/pkg/__init__.py`` which only contains
-     ``__version__`` — a release artifact, not user-facing code).
-
-  3. **Infrastructure patterns** (deny-list)
-     Path globs matching infrastructure files.  This is the union of
-     ``DEFAULT_INFRASTRUCTURE`` and the project's ``infrastructure`` list.
-     Changes to these don't trigger a release.
-
-  4. **Default**: user-facing (lowest priority — safe default)
-
-**Tag system** (orthogonal to release impact):
-  Projects can define custom tags (e.g., ``ansible``, ``docs``) for CI
-  conditional execution.  A file can be both infrastructure (no release)
-  and tagged ``ansible`` (run molecule tests).  Tags are evaluated
-  independently of the user-facing/infrastructure classification.
-  The ``--check`` CLI option accepts any tag name defined in the config,
-  and ``--github-output`` writes ``<tag>-changed`` for each configured tag.
-
-== Configuration ==
-
-In ``pyproject.toml``::
-
-    [tool.devx.classify]
-    # Whether to merge with DEFAULT_INFRASTRUCTURE (default: true).
-    # Set to false to specify all patterns explicitly.
-    # use_defaults = true
-
-    # Project-specific infrastructure paths (merged with defaults).
-    # Only list paths NOT already in DEFAULT_INFRASTRUCTURE.
-    infrastructure = [
-        "scripts/**",       # e.g., if scripts/ is dev-only tooling
-    ]
-
-    # Infrastructure overrides — files that would default to user-facing
-    # but are actually infrastructure
-    infrastructure_overrides = [
-        "src/mypkg/__init__.py",   # only contains __version__
-    ]
-
-    # User-facing overrides — safety override for broad infrastructure patterns
-    # (empty by default)
-    user_facing_overrides = []
-
-    # Tag patterns — additional categories for CI conditional execution
-    [tool.devx.classify.tags]
-    ansible = ["ansible/**", ".ansible-lint"]
-
-== What counts as "user-facing" ==
-
-A change is user-facing if it affects the behavior of the installed
-package.  For a library/CLI tool, this means:
-
-  - Source code in ``src/`` (except ``__init__.py`` which only holds
-    ``__version__``)
-  - Package metadata (``pyproject.toml`` — dependencies, entry points)
-  - Ansible roles, playbooks, templates (if the project ships Ansible)
-  - Translation files (user-visible messages)
-  - Any file not explicitly classified as infrastructure
-
-A change is infrastructure if it only affects the project's own
-development/CI environment:
-
-  - CI/CD workflows (``.gitea/**``, ``.github/**``)
-  - Tests (``tests/**``)
-  - Documentation (``docs/**``, ``README.md``, ``CHANGELOG.md``)
-  - Linting/formatting config (``.ruff.toml``, ``.pre-commit-config.yaml``)
-  - Build tooling (``Makefile``, ``cliff.toml``)
-  - Git hooks (``hooks/**``)
-  - Generated scripts (``activate.sh``, ``activate.fish``, ``activate.zsh``)
-
-== Glob Syntax ==
-
-Patterns support standard glob syntax:
-
-  - ``**`` matches any number of path segments (including zero)
-  - ``*`` matches any characters within a single path segment
-  - ``?`` matches a single character within a single path segment
-  - Everything else is matched literally
-
-Examples:
-  - ``.gitea/**`` matches ``.gitea/workflows/ci.yml``, ``.gitea/actionlint.yaml``
-  - ``tests/**`` matches ``tests/unit/test_cli.py``, ``tests/conftest.py``
-  - ``src/devx/__init__.py`` matches exactly that file
-  - ``Makefile`` matches exactly that file
-
-Usage:
-  python3 -m devx.ci.classify_changes [--base <ref>] [--head <ref>]
-  python3 -m devx.ci.classify_changes --base v0.3.0 --head HEAD
-  python3 -m devx.ci.classify_changes --check ansible --quiet
-  python3 -m devx.ci.classify_changes --github-output
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import subprocess  # nosec B404
-import sys
-import tomllib
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any
-
-import click
-
-from devx.ci._shared import get_latest_tag, write_github_output
-from devx.i18n import _
-
-# ---------------------------------------------------------------------------
-# Data structures
-# ---------------------------------------------------------------------------
-
-
-@dataclass(frozen=True)
-class FileClassification:
-    """Result of classifying a single file.
-
-    Attributes:
-        path: The file path relative to repo root.
-        is_user_facing: True if changes to this file require a release.
-        reason: Human-readable explanation of the classification.
-        matched_rule: Which rule matched (e.g., "infrastructure: .gitea/**").
-            None if the default rule was used.
-        tags: Custom category tags (e.g., {"ansible"}).
-    """
-
-    path: str
-    is_user_facing: bool
-    reason: str
-    matched_rule: str | None
-    tags: frozenset[str] = frozenset()
-
-
-@dataclass
-class ClassificationResult:
-    """Result of classifying a set of changed files.
-
-    Attributes:
-        files: Per-file classification details.
-        user_facing: List of file paths classified as user-facing.
-        infrastructure: List of file paths classified as infrastructure.
-        tags: Dict mapping tag name to list of file paths matching that tag.
-    """
-
-    files: list[FileClassification] = field(default_factory=list)
-    user_facing: list[str] = field(default_factory=list)
-    infrastructure: list[str] = field(default_factory=list)
-    tags: dict[str, list[str]] = field(default_factory=dict)
-
-    @property
-    def has_user_facing(self) -> bool:
-        """True if any user-facing files were found."""
-        return bool(self.user_facing)
-
-    def has_tag(self, tag: str) -> bool:
-        """True if any files matched the given tag."""
-        return bool(self.tags.get(tag))
-
-
-# ---------------------------------------------------------------------------
-# Glob matching
-# ---------------------------------------------------------------------------
-
-
-def _glob_to_regex(pattern: str) -> re.Pattern[str]:
-    """Convert a glob pattern to a compiled regex.
-
-    Supports:
-      - ``**``  -> matches any number of path segments (including zero)
-      - ``*``   -> matches any chars within a single path segment
-      - ``?``   -> matches a single char within a path segment
-      - All other characters are matched literally
-    """
-    # Handle ** at the end (e.g., ".gitea/**")
-    # ** matches anything including slashes
-    parts: list[str] = []
-    i = 0
-    while i < len(pattern):
-        c = pattern[i]
-        if c == "*" and i + 1 < len(pattern) and pattern[i + 1] == "*":
-            parts.append(".*")
-            i += 2
-            # Skip trailing slash after **
-            if i < len(pattern) and pattern[i] == "/":
-                i += 1
-        elif c == "*":
-            parts.append("[^/]*")
-            i += 1
-        elif c == "?":
-            parts.append("[^/]")
-            i += 1
-        else:
-            parts.append(re.escape(c))
-            i += 1
-    return re.compile("^" + "".join(parts) + "$")
-
-
-def _matches_glob(file_path: str, pattern: str) -> bool:
-    """Check if a file path matches a glob pattern.
-
-    Also supports prefix matching: if the pattern ends with ``/``,
-    any file starting with that prefix matches.  This is a convenience
-    for patterns like ``.gitea/`` (equivalent to ``.gitea/**``).
-    """
-    # Prefix matching for patterns ending with /
-    if pattern.endswith("/") and (file_path.startswith(pattern) or file_path == pattern.rstrip("/")):
-        return True
-    return _glob_to_regex(pattern).match(file_path) is not None
-
-
-# ---------------------------------------------------------------------------
-# Classifier
-# ---------------------------------------------------------------------------
-
-
-# ---------------------------------------------------------------------------
-# Default infrastructure patterns
-# ---------------------------------------------------------------------------
-
-# Common infrastructure paths that apply to ANY Python project using devx.
-# Projects inherit these automatically and only need to specify project-specific
-# paths in their [tool.devx.classify] section.
-#
-# Rationale: these files/directories are development tooling, CI/CD config,
-# or generated artifacts. Changes to them don't affect the installed package's
-# behavior, so they don't warrant a release.
-DEFAULT_INFRASTRUCTURE: list[str] = [
-    # CI/CD workflow definitions
-    ".gitea/**",
-    ".github/**",
-    # Test files
-    "tests/**",
-    # Documentation
-    "docs/**",
-    # Git hooks
-    "hooks/**",
-    # Build tooling
-    "Makefile",
-    "cliff.toml",
-    "uv.lock",
-    # Linting / formatting config
-    ".pre-commit-config.yaml",
-    ".ruff.toml",
-    ".ansible-lint",
-    ".checkmake.ini",
-    ".editorconfig",
-    # Environment templates (not the actual .env which is gitignored)
-    ".env.example",
-    # Git config
-    ".gitignore",
-    ".gitattributes",
-    # Project-level documentation (not part of the installed package)
-    "AGENTS.md",
-    "README.md",
-    "CHANGELOG.md",
-    "TROUBLESHOOTING.md",
-    "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md",
-    "REVIEW_CHECKLIST.md",
-    # Agent/CI tooling config (not part of the installed package)
-    ".devin/**",
-    # Generated venv activation scripts (created by `make setup`)
-    "activate.sh",
-    "activate.fish",
-    "activate.zsh",
-]
-
-
-@dataclass
-class ClassifierConfig:
-    """Configuration for the change classifier.
-
-    Loaded from ``[tool.devx.classify]`` in ``pyproject.toml``.
-
-    By default, the framework's ``DEFAULT_INFRASTRUCTURE`` patterns are
-    merged with the project's ``infrastructure`` list.  Set
-    ``use_defaults = false`` to disable defaults and specify all
-    patterns explicitly.
-
-    Attributes:
-        infrastructure: Glob patterns for infrastructure paths
-            (merged with DEFAULT_INFRASTRUCTURE unless use_defaults is False).
-        infrastructure_overrides: Exact paths that are infrastructure
-            despite not matching any infrastructure pattern.
-        user_facing_overrides: Exact paths that are user-facing
-            despite matching an infrastructure pattern (safety override).
-        tags: Dict mapping tag name to list of glob patterns.
-        use_defaults: If True (default), merge with DEFAULT_INFRASTRUCTURE.
-    """
-
-    infrastructure: list[str] = field(default_factory=list)
-    infrastructure_overrides: list[str] = field(default_factory=list)
-    user_facing_overrides: list[str] = field(default_factory=list)
-    tags: dict[str, list[str]] = field(default_factory=dict)
-    use_defaults: bool = True
-
-    @classmethod
-    def from_pyproject(cls, pyproject_path: str = "pyproject.toml") -> ClassifierConfig:
-        """Load classifier config from pyproject.toml.
-
-        Reads the ``[tool.devx.classify]`` section.  If the section or
-        file is missing, returns a config with only DEFAULT_INFRASTRUCTURE
-        (everything else defaults to user-facing — safe-by-default).
-        """
-        path = Path(pyproject_path)
-        if not path.exists():
-            return cls(infrastructure=list(DEFAULT_INFRASTRUCTURE))
-        with open(path, "rb") as f:  # noqa: PTH123
-            data: dict[str, Any] = tomllib.load(f)
-        classify_cfg = data.get("tool", {}).get("devx", {}).get("classify", {})
-
-        use_defaults = classify_cfg.get("use_defaults", True)
-        project_infra = list(classify_cfg.get("infrastructure", []))
-
-        if use_defaults:
-            # Merge defaults with project-specific patterns (deduplicated)
-            merged = list(DEFAULT_INFRASTRUCTURE)
-            for p in project_infra:
-                if p not in merged:
-                    merged.append(p)
-            infrastructure = merged
-        else:
-            infrastructure = project_infra
-
-        return cls(
-            infrastructure=infrastructure,
-            infrastructure_overrides=list(classify_cfg.get("infrastructure_overrides", [])),
-            user_facing_overrides=list(classify_cfg.get("user_facing_overrides", [])),
-            tags={k: list(v) for k, v in classify_cfg.get("tags", {}).items()},
-            use_defaults=use_defaults,
-        )
-
-
-class ChangeClassifier:
-    """Classify changed files as user-facing or infrastructure.
-
-    Uses layered rules with safe-by-default semantics.
-
-    Rule evaluation order (first match wins):
-      1. User-facing overrides (safety — highest priority)
-      2. Infrastructure overrides
-      3. Infrastructure patterns
-      4. Default: user-facing (safe)
-    """
-
-    def __init__(self, config: ClassifierConfig | None = None) -> None:
-        self.config = config or ClassifierConfig.from_pyproject()
-        # Pre-compile infrastructure patterns for efficiency
-        self._infra_patterns = list(self.config.infrastructure)
-        self._infra_overrides = set(self.config.infrastructure_overrides)
-        self._user_overrides = set(self.config.user_facing_overrides)
-
-    def classify_file(self, file_path: str) -> FileClassification:
-        """Classify a single file path.
-
-        Returns a FileClassification with the decision and reason.
-        """
-        tags = self._compute_tags(file_path)
-
-        # 1. User-facing overrides (highest priority — safety)
-        for pattern in self._user_overrides:
-            if _matches_glob(file_path, pattern):
-                return FileClassification(
-                    path=file_path,
-                    is_user_facing=True,
-                    reason=f"User-facing override (matches '{pattern}')",
-                    matched_rule="user_facing_overrides",
-                    tags=tags,
-                )
-
-        # 2. Infrastructure overrides
-        if file_path in self._infra_overrides:
-            return FileClassification(
-                path=file_path,
-                is_user_facing=False,
-                reason="Infrastructure override (explicitly listed)",
-                matched_rule="infrastructure_overrides",
-                tags=tags,
-            )
-
-        # 3. Infrastructure patterns
-        for pattern in self._infra_patterns:
-            if _matches_glob(file_path, pattern):
-                return FileClassification(
-                    path=file_path,
-                    is_user_facing=False,
-                    reason=f"Infrastructure (matches '{pattern}')",
-                    matched_rule=f"infrastructure: {pattern}",
-                    tags=tags,
-                )
-
-        # 4. Default: user-facing (safe-by-default)
-        return FileClassification(
-            path=file_path,
-            is_user_facing=True,
-            reason="User-facing (default — not in infrastructure patterns)",
-            matched_rule=None,
-            tags=tags,
-        )
-
-    def classify(self, files: list[str]) -> ClassificationResult:
-        """Classify a list of changed files.
-
-        Returns a ClassificationResult with per-file details and
-        aggregated lists.
-        """
-        result = ClassificationResult()
-        all_tags: dict[str, list[str]] = {}
-
-        for f in files:
-            fc = self.classify_file(f)
-            result.files.append(fc)
-            if fc.is_user_facing:
-                result.user_facing.append(f)
-            else:
-                result.infrastructure.append(f)
-            for tag in fc.tags:
-                all_tags.setdefault(tag, []).append(f)
-
-        result.tags = all_tags
-        return result
-
-    def _compute_tags(self, file_path: str) -> frozenset[str]:
-        """Compute custom category tags for a file path."""
-        matched: set[str] = set()
-        for tag_name, patterns in self.config.tags.items():
-            for pattern in patterns:
-                if _matches_glob(file_path, pattern):
-                    matched.add(tag_name)
-                    break
-        return frozenset(matched)
-
-
-# ---------------------------------------------------------------------------
-# Git helpers
-# ---------------------------------------------------------------------------
-
-
-def run_git(args: list[str]) -> str:
-    """Run a git command and return stdout."""
-    result = subprocess.run(  # nosec B603
-        args,
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise click.ClickException(
-            _("git command failed ({cmd}): {stderr}", cmd=" ".join(args), stderr=result.stderr.strip())
-        )
-    return result.stdout.strip()
-
-
-def get_changed_files(base: str, head: str) -> list[str]:
-    """Get list of files changed between base and head refs."""
-    output = run_git(["git", "diff", "--name-only", base, head])
-    if not output:
-        return []
-    return output.split("\n")
-
-
-# ---------------------------------------------------------------------------
-# Backward-compatible API (used by release.py and CI workflows)
-# ---------------------------------------------------------------------------
-
-# Singleton classifier — loaded lazily from pyproject.toml
-_classifier: ChangeClassifier | None = None
-
-
-def _get_classifier() -> ChangeClassifier:
-    """Get or create the singleton classifier from pyproject.toml."""
-    global _classifier  # noqa: PLW0603
-    if _classifier is None:
-        _classifier = ChangeClassifier()
-    return _classifier
-
-
-def is_workflow_only(
-    file_path: str,
-    patterns: frozenset[str] | None = None,
-) -> bool:
-    """Check if a file path is infrastructure (not user-facing).
-
-    Backward-compatible API.  Prefer ``ChangeClassifier.classify_file()``
-    for new code.
-
-    Args:
-        file_path: Path relative to repo root.
-        patterns: Deprecated.  If provided, uses simple prefix matching
-            against these patterns instead of the config-driven classifier.
-    """
-    if patterns is not None:
-        # Legacy mode — simple prefix matching
-        return any(file_path.startswith(p) or file_path == p for p in patterns)
-    return not _get_classifier().classify_file(file_path).is_user_facing
-
-
-def is_user_facing(
-    file_path: str,
-    patterns: frozenset[str] | None = None,
-) -> bool:
-    """Check if a file path is user-facing (affects the released package).
-
-    Inverse of ``is_workflow_only()``.
-    """
-    return not is_workflow_only(file_path, patterns)
-
-
-def classify_changes(
-    files: list[str],
-    patterns: frozenset[str] | None = None,
-) -> dict[str, list[str]]:
-    """Classify changed files into user-facing and workflow-only.
-
-    Returns a dict with keys "user_facing" and "workflow_only".
-    """
-    if patterns is not None:
-        # Legacy mode
-        user_facing: list[str] = []
-        workflow_only: list[str] = []
-        for f in files:
-            if is_user_facing(f, patterns):
-                user_facing.append(f)
-            else:
-                workflow_only.append(f)
-        return {"user_facing": user_facing, "workflow_only": workflow_only}
-
-    result = _get_classifier().classify(files)
-    return {"user_facing": result.user_facing, "workflow_only": result.infrastructure}
-
-
-def has_user_facing_changes(
-    base: str,
-    head: str,
-    patterns: frozenset[str] | None = None,
-) -> bool:
-    """Check if any user-facing files changed between base and head.
-
-    Imported by ``devx.ci.release`` to decide whether a release is needed.
-    """
-    files = get_changed_files(base, head)
-    if patterns is not None:
-        return any(is_user_facing(f, patterns) for f in files)
-    return _get_classifier().classify(files).has_user_facing
-
-
-# ---------------------------------------------------------------------------
-# Gitea Actions output
-# ---------------------------------------------------------------------------
-
-
-# ---------------------------------------------------------------------------
-# Classification logic
-# ---------------------------------------------------------------------------
-# CLI
-# ---------------------------------------------------------------------------
-
-
-@click.command()
-@click.option("--base", default=None, help="Base ref (default: latest tag).")
-@click.option("--head", default="HEAD", help="Head ref (default: HEAD).")
-@click.option("--quiet", is_flag=True, default=False, help="Only output true/false.")
-@click.option(
-    "--check",
-    default="all",
-    help="Check specific category: 'all' (default), 'user-facing', or any tag name "
-    "defined in [tool.devx.classify.tags] (e.g., 'ansible').",
-)
-@click.option(
-    "--github-output",
-    "github_output",
-    is_flag=True,
-    default=False,
-    help="Write results to $GITHUB_OUTPUT file (for CI workflow steps). "
-    "Outputs 'user-facing-changed' and '<tag>-changed' for each configured tag.",
-)
-@click.option(
-    "--force",
-    is_flag=True,
-    default=False,
-    help="Force user-facing-changed=true regardless of actual changes. "
-    "Used by workflow_dispatch with force-deploy input.",
-)
-def main(base: str | None, head: str, quiet: bool, check: str, github_output: bool, force: bool) -> None:
-    """Classify git changes and output results."""
-    classifier = _get_classifier()
-    available_tags = list(classifier.config.tags.keys())
-
-    # --force can also be activated via FORCE_DEPLOY env var (for workflow_dispatch)
-    if os.environ.get("FORCE_DEPLOY", "").lower() == "true":
-        force = True
-
-    if force and github_output:
-        write_github_output("user-facing-changed", "true")
-        for tag in available_tags:
-            write_github_output(f"{tag}-changed", "true")
-        click.echo("Forced user-facing-changed=true via --force flag.")
-        return
-
-    if base is None:
-        base = get_latest_tag()
-        if not base:
-            if github_output:
-                write_github_output("user-facing-changed", "true")
-                for tag in available_tags:
-                    write_github_output(f"{tag}-changed", "true")
-                click.echo("No tags found — treating all changes as user-facing.")
-                return
-            if quiet:
-                click.echo("true")
-            else:
-                click.echo(_("No tags found — treating all changes as user-facing."))
-            return
-
-    files = get_changed_files(base, head)
-    if not files:
-        if github_output:
-            write_github_output("user-facing-changed", "false")
-            for tag in available_tags:
-                write_github_output(f"{tag}-changed", "false")
-            click.echo(f"No changes between {base} and {head}.")
-            return
-        if quiet:
-            click.echo("false")
-        else:
-            click.echo(_("No changes between {base} and {head}.", base=base, head=head))
-        return
-
-    result = classifier.classify(files)
-
-    if github_output:
-        write_github_output("user-facing-changed", "true" if result.has_user_facing else "false")
-        for tag in available_tags:
-            write_github_output(f"{tag}-changed", "true" if result.has_tag(tag) else "false")
-        click.echo(f"User-facing files changed: {result.has_user_facing}")
-        for tag in available_tags:
-            click.echo(f"{tag.capitalize()} files changed: {result.has_tag(tag)}")
-        return
-
-    # --check: check a specific tag or user-facing
-    if check != "all":
-        if check == "user-facing":
-            checked_files = result.user_facing
-            has_checked = bool(checked_files)
-            label = "User-facing"
-        elif check in available_tags:
-            checked_files = result.tags.get(check, [])
-            has_checked = bool(checked_files)
-            label = check.capitalize()
-        else:
-            raise click.ClickException(
-                _(
-                    "Unknown check category '{check}'. Available: all, user-facing{tags}",
-                    check=check,
-                    tags=", " + ", ".join(available_tags) if available_tags else "",
-                )
-            )
-        if quiet:
-            click.echo("true" if has_checked else "false")
-            return
-        click.echo(_("\n{label} files changed ({count}):", label=label, count=len(checked_files)))
-        for f in checked_files:
-            click.echo(f"  {f}")
-        click.echo(
-            _("\nResult: {status}", status=f"{label} changes detected" if has_checked else f"No {label} changes")
-        )
-        return
-
-    has_user = result.has_user_facing
-
-    if quiet:
-        click.echo("true" if has_user else "false")
-        return
-
-    click.echo(_("Comparing {base}..{head} ({count} files changed)", base=base, head=head, count=len(files)))
-    click.echo(_("\nUser-facing changes ({count}):", count=len(result.user_facing)))
-    for f in result.user_facing:
-        click.echo(f"  {f}")
-    click.echo(_("\nWorkflow-only changes ({count}):", count=len(result.infrastructure)))
-    for f in result.infrastructure:
-        click.echo(f"  {f}")
-    for tag in available_tags:
-        tag_files = result.tags.get(tag, [])
-        if tag_files:
-            click.echo(_("\n{tag} files ({count}):", tag=tag.capitalize(), count=len(tag_files)))
-            for f in tag_files:
-                click.echo(f"  {f}")
-    if has_user:
-        status = "USER-FACING changes detected — release needed"
-    else:
-        status = "Workflow-only changes — no release needed"
-    click.echo(_("\nResult: {status}", status=status))
-
-    if not has_user:
-        sys.exit(2)  # Exit code 2 = workflow-only (used by CI to skip release)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,76 +0,0 @@
-#!/usr/bin/env python3
-"""Detect whether the latest git commit is an automated CI commit.
-
-Release commits have the format ``release: vX.Y.Z``.
-Badge commits have the format ``chore: update badge URLs ... [skip ci]``.
-Both are generated by CI and should skip post-merge jobs.
-
-This script writes ``is-release=true`` or ``is-release=false`` to
-``$GITHUB_OUTPUT`` for use in CI workflow conditionals.
-
-Usage::
-
-    python3 -m devx.ci.detect_release_commit
-"""
-
-from __future__ import annotations
-
-import re
-import subprocess  # nosec B404
-
-import click
-
-from devx.ci._shared import write_github_output
-from devx.i18n import _
-
-RELEASE_RE = re.compile(r"^release: v\d+\.\d+\.\d+")
-BADGE_RE = re.compile(r"^chore: update badge URLs.*\[skip ci\]")
-
-
-def get_commit_message() -> str:
-    """Get the subject of the latest git commit."""
-    result = subprocess.run(  # nosec B603 B607
-        ["git", "log", "-1", "--pretty=%s"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise click.ClickException(f"git log failed: {result.stderr.strip()}")
-    return result.stdout.strip()
-
-
-def is_release_commit(message: str) -> bool:
-    """Check if a commit message matches the release commit format."""
-    return bool(RELEASE_RE.match(message))
-
-
-def is_badge_commit(message: str) -> bool:
-    """Check if a commit message matches the badge commit format."""
-    return bool(BADGE_RE.match(message))
-
-
-def is_automated_commit(message: str) -> bool:
-    """Check if a commit is an automated CI commit (release or badge)."""
-    return is_release_commit(message) or is_badge_commit(message)
-
-
-@click.command()
-def main() -> None:
-    """Detect if the latest commit is an automated CI commit and set GITHUB_OUTPUT."""
-    msg = get_commit_message()
-    click.echo(_("Commit message: {msg}", msg=msg))
-    is_release = is_release_commit(msg)
-    is_automated = is_automated_commit(msg)
-    write_github_output("is-release", "true" if is_release else "false")
-    write_github_output("is-automated", "true" if is_automated else "false")
-    if is_release:
-        click.echo(_("Release commit — skipping all post-merge jobs."))
-    elif is_automated:
-        click.echo(_("Automated CI commit (badge) — skipping post-merge jobs."))
-    else:
-        click.echo(_("Regular merge commit — running all post-merge jobs."))
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,194 +0,0 @@
-#!/usr/bin/env python3
-"""Discover available Gitea Actions runners for dynamic job distribution.
-
-Queries the Gitea API for registered runners at three levels:
-  1. Repository level: GET /repos/{owner}/{repo}/actions/runners
-  2. Organization level: GET /orgs/{org}/actions/runners
-  3. Instance (admin) level: GET /admin/actions/runners
-
-Falls back to the ``MOLECULE_RUNNERS`` repo variable or environment
-variable, then to ``DEFAULT_MAX_RUNNERS`` (3).
-
-Outputs:
-  - ``--count``: prints the number of available runners
-  - ``--indices``: prints a JSON array [0, 1, ..., N-1] for use as a
-    dynamic matrix in Gitea Actions
-  - (default): prints both as ``count=N`` and ``indices=[0,1,...]``
-
-Usage:
-  python3 -m devx.ci.discover_runners --owner oblachno-oss --repo devx
-  python3 -m devx.ci.discover_runners --indices
-  python3 -m devx.ci.discover_runners --count
-"""
-
-from __future__ import annotations
-
-import json
-import os
-
-import click
-import requests
-
-from devx.config import GITEA_API_URL, REPO_NAME, REPO_OWNER
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-DEFAULT_MAX_RUNNERS = 3
-
-
-def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
-    """Query the Gitea API for registered runners at all levels.
-
-    Returns the total count of active runners.  If the API call fails
-    (e.g., no admin access for instance-level runners), falls back to
-    what we can see.  Fallbacks are logged to stderr for debugging.
-    """
-    headers = {"Authorization": f"token {token}"}
-    total = 0
-
-    # 1. Repository-level runners
-    try:
-        r = requests.get(
-            f"{api_url}/repos/{owner}/{repo}/actions/runners",
-            headers=headers,
-            timeout=10,
-        )
-        if r.status_code == 200:
-            data = r.json()
-            total += data.get("total_count", 0)
-        else:
-            click.echo(_("Warning: repo-level runners query returned HTTP {status}", status=r.status_code), err=True)
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: repo-level runners query failed: {error}", error=e), err=True)
-
-    # 2. Organization-level runners
-    try:
-        r = requests.get(
-            f"{api_url}/orgs/{owner}/actions/runners",
-            headers=headers,
-            timeout=10,
-        )
-        if r.status_code == 200:
-            data = r.json()
-            total += data.get("total_count", 0)
-        else:
-            click.echo(_("Warning: org-level runners query returned HTTP {status}", status=r.status_code), err=True)
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: org-level runners query failed: {error}", error=e), err=True)
-
-    # 3. Instance-level runners (requires admin scope)
-    try:
-        r = requests.get(
-            f"{api_url}/admin/actions/runners",
-            headers=headers,
-            timeout=10,
-        )
-        if r.status_code == 200:
-            data = r.json()
-            total += data.get("total_count", 0)
-        elif r.status_code != 403:  # 403 is expected without admin scope
-            click.echo(
-                _("Warning: instance-level runners query returned HTTP {status}", status=r.status_code),
-                err=True,
-            )
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: instance-level runners query failed: {error}", error=e), err=True)
-
-    return total
-
-
-def get_runner_count(api_url: str, token: str | None, owner: str, repo: str) -> int:
-    """Determine the number of available runners.
-
-    Tries the Gitea API first, then falls back to env vars, then default.
-    """
-    # Try API query if we have a token
-    if token:
-        api_count = query_runners(api_url, token, owner, repo)
-        if api_count > 0:
-            return api_count
-
-    # Fall back to MOLECULE_RUNNERS env var (set by CI from repo variable)
-    env_count = os.environ.get("MOLECULE_RUNNERS")
-    if env_count:
-        try:
-            count = int(env_count)
-            if count > 0:
-                return count
-        except ValueError:
-            pass
-
-    # Fall back to default
-    return DEFAULT_MAX_RUNNERS
-
-
-def generate_indices(count: int) -> list[str]:
-    """Generate a list of runner indices ["1", "2", ..., "N"].
-
-    Uses 1-based string indices because Gitea Actions renders
-    integer 0 and string "0" as empty in ${{ matrix.runner-index }}
-    expressions, causing --runner-index to be passed without a value.
-    The distribute_molecule.py script converts these back to 0-based
-    internally.
-    """
-    return [str(i + 1) for i in range(count)]
-
-
-@click.command()
-@click.option("--owner", default=None, help="Repository owner (for API query).")
-@click.option("--repo", default=None, help="Repository name (for API query).")
-@click.option("--count", "output_count", is_flag=True, help="Output only the count.")
-@click.option("--indices", "output_indices", is_flag=True, help="Output only the JSON indices array.")
-@click.option(
-    "--github-output",
-    "github_output",
-    is_flag=True,
-    default=False,
-    help="Write results to $GITHUB_OUTPUT file (for CI workflow steps).",
-)
-def main(
-    owner: str | None,
-    repo: str | None,
-    output_count: bool,
-    output_indices: bool,
-    github_output: bool,
-) -> None:
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        token = None
-
-    if owner is None:
-        owner = os.environ.get("DEVX_REPO_OWNER", "") or REPO_OWNER
-    if repo is None:
-        repo = os.environ.get("DEVX_REPO_NAME", "") or REPO_NAME
-
-    count = get_runner_count(GITEA_API_URL, token, owner, repo)
-    indices = generate_indices(count)
-
-    if github_output:
-        gh_output = os.environ.get("GITHUB_OUTPUT")
-        if not gh_output:
-            raise click.ClickException("GITHUB_OUTPUT environment variable is not set")
-        with open(gh_output, "a", encoding="utf-8") as f:  # noqa: PTH123
-            f.write(f"runner-count={count}\n")
-            f.write(f"runner-indices={json.dumps(indices)}\n")
-        click.echo(_("Runner count: {count}", count=count))
-        click.echo(_("Runner indices: {indices}", indices=indices))
-        return
-
-    if output_count:
-        click.echo(str(count))
-        return
-
-    if output_indices:
-        click.echo(json.dumps(indices))
-        return
-
-    # Default: output both as key=value pairs for CI consumption
-    click.echo(_("count={count}", count=count))
-    click.echo(_("indices={indices}", indices=json.dumps(indices)))
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,139 +0,0 @@
-#!/usr/bin/env python3
-"""Distribute a list of files across N parallel runners using LPT scheduling.
-
-Generic file-based test distribution for CI matrix jobs. Discovers files
-matching a glob pattern, sorts them for deterministic ordering, then
-assigns them to *max_runners* groups using LPT (Longest Processing Time
-first) scheduling — files are weighted by size (as a proxy for test
-runtime) and assigned to the runner with the least total weight.
-
-The assigned group for *runner_index* is written to ``$GITHUB_ENV`` for
-use by subsequent steps.
-
-Usage::
-
-    python3 -m devx.ci.distribute_files \\
-        --pattern "tests/integration/test_*.py" \\
-        --runner-index 1 \\
-        --max-runners 3 \\
-        --github-env --skip-if-excess
-"""
-
-from __future__ import annotations
-
-import glob
-import os
-
-import click
-
-from devx.ci._shared import lpt_distribute, write_github_env
-from devx.i18n import _
-
-DEFAULT_MAX_RUNNERS = 3
-
-
-def discover_files(pattern: str) -> list[str]:
-    """Return sorted list of file paths matching *pattern*."""
-    return sorted(glob.glob(pattern))
-
-
-def _file_weight(path: str) -> int:
-    """Estimate a weight for a file based on its size in bytes.
-
-    Falls back to 1 if the file cannot be stat'd (e.g. in tests).
-    """
-    try:
-        return max(1, os.path.getsize(path))
-    except OSError:
-        return 1
-
-
-def distribute(files: list[str], max_runners: int) -> list[list[str]]:
-    """Split *files* into *max_runners* balanced groups using LPT scheduling.
-
-    Files are weighted by size (as a proxy for runtime) and assigned to
-    the runner with the least total weight.
-    """
-    weights = [_file_weight(f) for f in files]
-    return lpt_distribute(files, weights, max_runners)
-
-
-def files_for_runner(files: list[str], runner_index: int, max_runners: int) -> list[str]:
-    """Return the subset of files assigned to *runner_index* (0-based)."""
-    groups = distribute(files, max_runners)
-    if runner_index < 0 or runner_index >= len(groups):
-        raise click.ClickException(
-            _("Runner index {index} out of range (0..{max})", index=runner_index, max=max_runners - 1)
-        )
-    return groups[runner_index]
-
-
-@click.command()
-@click.option("--pattern", required=True, help="Glob pattern for files to distribute.")
-@click.option(
-    "--runner-index",
-    type=int,
-    default=None,
-    help="One-based runner index. If omitted, prints all groups.",
-)
-@click.option(
-    "--max-runners",
-    type=int,
-    default=DEFAULT_MAX_RUNNERS,
-    show_default=True,
-    help="Total number of parallel runners.",
-)
-@click.option(
-    "--github-env",
-    is_flag=True,
-    default=False,
-    help="Write ASSIGNED_FILES and SKIP to $GITHUB_ENV.",
-)
-@click.option(
-    "--skip-if-excess",
-    is_flag=True,
-    default=False,
-    help="With --github-env: write SKIP=true when runner-index exceeds max-runners.",
-)
-def main(pattern: str, runner_index: int | None, max_runners: int, github_env: bool, skip_if_excess: bool) -> None:
-    files = discover_files(pattern)
-
-    if runner_index is None:
-        groups = distribute(files, max_runners)
-        for i, group in enumerate(groups):
-            labels = " ".join(group) if group else "(none)"
-            click.echo(_("Runner {i}: {labels}", i=i, labels=labels))
-        return
-
-    if skip_if_excess and github_env and runner_index > max_runners:
-        click.echo(
-            _(
-                "Skipping — runner index {runner_index} > max runners {max_runners}",
-                runner_index=runner_index,
-                max_runners=max_runners,
-            )
-        )
-        write_github_env("ASSIGNED_FILES", "")
-        write_github_env("SKIP", "true")
-        return
-
-    if runner_index < 1:
-        raise click.ClickException(
-            _("Runner index {runner_index} is out of range (must be >= 1)", runner_index=runner_index)
-        )
-
-    zero_based = runner_index - 1
-    assigned = files_for_runner(files, zero_based, max_runners)
-    encoded = "\n".join(assigned)
-
-    if github_env:
-        write_github_env("ASSIGNED_FILES", encoded)
-        write_github_env("SKIP", "false")
-        click.echo(_("Assigned {count} files to runner {runner_index}", count=len(assigned), runner_index=runner_index))
-        return
-
-    click.echo(encoded)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,206 +0,0 @@
-#!/usr/bin/env python3
-"""Distribute a list of items across N parallel runners using LPT scheduling.
-
-Generic item distribution for CI matrix jobs. Items are read from a JSON
-array on stdin (or from a file via --items-file), sorted for deterministic
-ordering, then assigned to *max_runners* groups using LPT (Longest
-Processing Time first) scheduling.
-
-Each item is a string (e.g. an Ansible ``--limit`` pattern like
-``observability`` or ``customer-1-vm``). Optionally, items can be objects
-with ``{"id": "...", "weight": N}`` to provide explicit weights.
-
-The assigned group for *runner_index* is written to ``$GITHUB_ENV`` as
-``ASSIGNED_ITEMS`` (space-delimited) for use by subsequent steps.
-
-Usage::
-
-    echo '["observability", "customer-1-vm"]' | \\
-        python3 -m devx.ci.distribute_items \\
-        --runner-index 1 --max-runners 3 \\
-        --github-env --skip-if-excess
-
-    # With weights:
-    echo '[{"id": "observability", "weight": 5}, {"id": "customer-1", "weight": 3}]' | \\
-        python3 -m devx.ci.distribute_items \\
-        --runner-index 1 --max-runners 3 --github-env
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-
-import click
-
-from devx.ci._shared import lpt_distribute, write_github_env
-from devx.i18n import _
-
-DEFAULT_MAX_RUNNERS = 3
-DEFAULT_WEIGHT = 1
-
-
-def parse_items(raw: str) -> list[str]:
-    """Parse a JSON array into a list of item identifier strings.
-
-    Accepts both plain string arrays (``["a", "b"]``) and object arrays
-    (``[{"id": "a", "weight": 2}]``). Returns just the identifier strings.
-    """
-    data = json.loads(raw)
-    if not isinstance(data, list):
-        raise click.ClickException(_("Items input must be a JSON array, got {type}", type=type(data).__name__))
-    items: list[str] = []
-    for entry in data:
-        if isinstance(entry, str):
-            items.append(entry)
-        elif isinstance(entry, dict) and "id" in entry:
-            items.append(str(entry["id"]))
-        else:
-            raise click.ClickException(
-                _("Each item must be a string or an object with 'id', got {type}", type=type(entry).__name__)
-            )
-    return items
-
-
-def parse_weighted_items(raw: str) -> tuple[list[str], list[int]]:
-    """Parse a JSON array into (items, weights) lists.
-
-    For plain string arrays, all items get ``DEFAULT_WEIGHT``.
-    For object arrays, the ``weight`` field is used (default: ``DEFAULT_WEIGHT``).
-    """
-    data = json.loads(raw)
-    if not isinstance(data, list):
-        raise click.ClickException(_("Items input must be a JSON array, got {type}", type=type(data).__name__))
-    items: list[str] = []
-    weights: list[int] = []
-    for entry in data:
-        if isinstance(entry, str):
-            items.append(entry)
-            weights.append(DEFAULT_WEIGHT)
-        elif isinstance(entry, dict) and "id" in entry:
-            items.append(str(entry["id"]))
-            weights.append(int(entry.get("weight", DEFAULT_WEIGHT)))
-        else:
-            raise click.ClickException(
-                _("Each item must be a string or an object with 'id', got {type}", type=type(entry).__name__)
-            )
-    return items, weights
-
-
-def distribute(items: list[str], weights: list[int], max_runners: int) -> list[list[str]]:
-    """Split *items* into *max_runners* balanced groups using LPT scheduling.
-
-    Items are sorted by weight (descending), then assigned to the runner
-    with the least total weight.
-    """
-    return lpt_distribute(items, weights, max_runners)
-
-
-def items_for_runner(items: list[str], weights: list[int], runner_index: int, max_runners: int) -> list[str]:
-    """Return the subset of items assigned to *runner_index* (0-based)."""
-    groups = distribute(items, weights, max_runners)
-    if runner_index < 0 or runner_index >= len(groups):
-        raise click.ClickException(
-            _("Runner index {index} out of range (0..{max})", index=runner_index, max=max_runners - 1)
-        )
-    return groups[runner_index]
-
-
-@click.command()
-@click.option(
-    "--items-file",
-    type=click.Path(exists=True, file_okay=True, path_type=None),
-    default=None,
-    help="Read items from a JSON file instead of stdin.",
-)
-@click.option(
-    "--runner-index",
-    type=int,
-    default=None,
-    help="One-based runner index. If omitted, prints all groups.",
-)
-@click.option(
-    "--max-runners",
-    type=int,
-    default=DEFAULT_MAX_RUNNERS,
-    show_default=True,
-    help="Total number of parallel runners.",
-)
-@click.option(
-    "--github-env",
-    is_flag=True,
-    default=False,
-    help="Write ASSIGNED_ITEMS and SKIP to $GITHUB_ENV.",
-)
-@click.option(
-    "--skip-if-excess",
-    is_flag=True,
-    default=False,
-    help="With --github-env: write SKIP=true when runner-index exceeds max-runners.",
-)
-def main(
-    items_file: str | None,
-    runner_index: int | None,
-    max_runners: int,
-    github_env: bool,
-    skip_if_excess: bool,
-) -> None:
-    # Read items from file or stdin
-    if items_file is not None:
-        with open(items_file, encoding="utf-8") as f:  # noqa: PTH123
-            raw = f.read()
-    else:
-        raw = sys.stdin.read()
-
-    raw = raw.strip()
-    if not raw:
-        raw = "[]"
-
-    items, weights = parse_weighted_items(raw)
-
-    if runner_index is None:
-        groups = distribute(items, weights, max_runners)
-        for i, group in enumerate(groups):
-            labels = " ".join(group) if group else "(none)"
-            click.echo(_("Runner {i}: {labels}", i=i, labels=labels))
-        return
-
-    if skip_if_excess and github_env and runner_index > max_runners:
-        click.echo(
-            _(
-                "Skipping — runner index {runner_index} > max runners {max_runners}",
-                runner_index=runner_index,
-                max_runners=max_runners,
-            )
-        )
-        write_github_env("ASSIGNED_ITEMS", "")
-        write_github_env("SKIP", "true")
-        return
-
-    if runner_index < 1:
-        raise click.ClickException(
-            _("Runner index {runner_index} is out of range (must be >= 1)", runner_index=runner_index)
-        )
-
-    zero_based = runner_index - 1
-    assigned = items_for_runner(items, weights, zero_based, max_runners)
-    encoded = " ".join(assigned)
-
-    if github_env:
-        write_github_env("ASSIGNED_ITEMS", encoded)
-        write_github_env("SKIP", "false")
-        click.echo(
-            _(
-                "Assigned {count} items to runner {runner_index}: {encoded}",
-                count=len(assigned),
-                runner_index=runner_index,
-                encoded=encoded,
-            )
-        )
-        return
-
-    click.echo(encoded)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,266 +0,0 @@
-#!/usr/bin/env python3
-"""Check documentation coverage for CLI commands and major modules.
-
-Parses Click commands from the CLI source code and checks if each command
-has corresponding documentation in the wiki/docs.  Reports missing
-documentation as warnings and exits with non-zero if coverage is below 100%.
-
-By default, checks the current repository's own source and docs directories.
-When run from the devx package itself (development mode), it checks devx's
-own files. When installed as a package, it checks the consuming repo's files.
-
-Usage:
-  python3 -m devx.ci.doc_coverage [--docs-dir docs/] [--source-dir src/] [--fail-on-missing]
-"""
-
-from __future__ import annotations
-
-import re
-import sys
-from pathlib import Path
-
-import click
-
-from devx.config import _load_pyproject_devx
-from devx.i18n import _
-
-# Default to the current working directory (consuming repo's root)
-REPO_ROOT = Path.cwd()
-DOCS_DIR = REPO_ROOT / "docs"
-
-# Major modules that should be documented in tech/architecture.md
-# These are devx-specific; when checking other repos, use --source-dir
-REQUIRED_MODULES = [
-    "cli.py",
-    "i18n.py",
-    "exceptions.py",
-    "api_clients.py",
-    "config.py",
-    "gitea_cli.py",
-]
-
-# CI scripts that should be documented in tech/ci-cd-workflow.md
-REQUIRED_SCRIPTS = [
-    "auto_merge.py",
-    "release.py",
-    "publish.py",
-    "pr_review.py",
-    "notify_failure.py",
-    "post_merge.py",
-    "classify_changes.py",
-    "discover_runners.py",
-    "detect_release_commit.py",
-    "push_badges.py",
-    "distribute_molecule.py",
-    "molecule_ci_guard.py",
-    "validate_commit_msg.py",
-]
-
-
-def extract_cli_commands(source_dir: Path) -> list[str]:
-    """Extract command names from the CLI source file."""
-    # Try to find the CLI file in the source directory
-    cli_file = None
-    for candidate in source_dir.rglob("cli.py"):
-        cli_file = candidate
-        break
-    if cli_file is None or not cli_file.exists():
-        return []
-    content = cli_file.read_text()
-    commands: list[str] = []
-    # Find all @<group>.command("name") occurrences in the CLI source
-    # Matches @cli.command, @ci.command, @tools.command, @molecule.command
-    for match in re.finditer(r"@\w+\.command\b", content):
-        # Check for explicit name="..." in the decorator arguments
-        # Use a balanced paren search to find the end of the decorator
-        # (handles nested parens like @cli.command(help=_("...")))
-        depth = 0
-        decorator_end = match.start()
-        for i in range(match.start(), len(content)):
-            if content[i] == "(":
-                depth += 1
-            elif content[i] == ")":
-                depth -= 1
-                if depth == 0:
-                    decorator_end = i
-                    break
-        decorator_text = content[match.start() : decorator_end + 1]
-        # Look for explicit name="..." parameter (not help=, not other kwargs)
-        name_match = re.search(r'\bname\s*=\s*["\']([^"\']+)["\']', decorator_text)
-        if name_match:
-            commands.append(name_match.group(1))
-            continue
-        # Look for a positional string argument (e.g. @cli.command("my-cmd"))
-        # but skip if the only strings are in help= or other keyword args
-        positional_match = re.search(r'@\w+\.command\s*\(\s*["\']([^"\']+)["\']', decorator_text)
-        if positional_match:
-            commands.append(positional_match.group(1))
-            continue
-        # Find the next def statement after this decorator
-        after = content[decorator_end:]
-        def_match = re.search(r"def\s+(\w+)\s*\(", after)
-        if def_match:
-            commands.append(def_match.group(1))
-    return commands
-
-
-def check_command_documented(command: str, docs_content: str) -> bool:
-    """Check if a CLI command is documented in the docs content."""
-    # Look for the command name as a heading or in code blocks
-    # Also matches subgroup prefixes like "devx ci release" or "devx tools setup"
-    patterns = [
-        rf"##.*\b{re.escape(command)}\b",
-        rf"`devx\s+(?:\w+\s+)?{re.escape(command)}\b",
-        rf"\bdevx\s+(?:\w+\s+)?{re.escape(command)}\b",
-        rf"###.*\b{re.escape(command)}\b",
-    ]
-    return any(re.search(p, docs_content, re.IGNORECASE) for p in patterns)
-
-
-def check_module_documented(module: str, docs_content: str) -> bool:
-    """Check if a module is mentioned in the docs content."""
-    return module in docs_content
-
-
-@click.command()
-@click.option("--docs-dir", default=None, help="Path to the docs directory (default: ./docs).")
-@click.option("--source-dir", default=None, help="Path to the source directory (default: auto-detect from src/).")
-@click.option(
-    "--ci-scripts-dir",
-    default=None,
-    help=(
-        "Path to CI scripts directory (default: auto-detect from src/ci/). "
-        "Set to empty string to skip CI script checks."
-    ),
-)
-@click.option(
-    "--fail-on-missing",
-    is_flag=True,
-    default=False,
-    help="Exit with non-zero status if any documentation is missing.",
-)
-def main(docs_dir: str | None, source_dir: str | None, ci_scripts_dir: str | None, fail_on_missing: bool) -> None:
-    root = Path.cwd()
-    docs_path = Path(docs_dir) if docs_dir else root / "docs"
-
-    # Read [tool.devx.doc_coverage] config from pyproject.toml
-    devx_cfg = _load_pyproject_devx()
-    doc_cov_cfg_raw: object = devx_cfg.get("doc_coverage", {}) if isinstance(devx_cfg, dict) else {}
-    doc_cov_cfg: dict[str, object] = doc_cov_cfg_raw if isinstance(doc_cov_cfg_raw, dict) else {}
-
-    # CLI args override config; config overrides defaults
-    if ci_scripts_dir is None and "ci_scripts_dir" in doc_cov_cfg:
-        ci_scripts_dir = str(doc_cov_cfg["ci_scripts_dir"])
-    if docs_dir is None and "docs_dir" in doc_cov_cfg:
-        docs_dir = str(doc_cov_cfg["docs_dir"])
-        docs_path = Path(docs_dir)
-    if source_dir is None and "source_dir" in doc_cov_cfg:
-        source_dir = str(doc_cov_cfg["source_dir"])
-
-    # Auto-detect source directory
-    if source_dir:
-        src_path = Path(source_dir)
-    else:
-        # Try common source directories
-        for candidate in [root / "src", root / "scripts"]:
-            if candidate.exists():
-                src_path = candidate
-                break
-        else:
-            src_path = root / "src"
-
-    cli_commands_file = docs_path / "user" / "cli-commands.md"
-    architecture_file = docs_path / "tech" / "architecture.md"
-    ci_cd_file = docs_path / "tech" / "ci-cd-workflow.md"
-
-    missing: list[str] = []
-    total = 0
-
-    # Check CLI commands
-    click.echo(_("Checking CLI command documentation..."))
-    commands = extract_cli_commands(src_path)
-    total += len(commands)
-    cli_docs = cli_commands_file.read_text() if cli_commands_file.exists() else ""
-    for cmd in commands:
-        if check_command_documented(cmd, cli_docs):
-            click.echo(_("  OK: {cmd}", cmd=cmd))
-        else:
-            click.echo(_("  MISSING: {cmd}", cmd=cmd))
-            missing.append(f"CLI command: {cmd}")
-
-    # Check modules in architecture.md
-    # Auto-detect modules from source directory (top-level only, exclude subdirs)
-    click.echo(_("\nChecking module documentation in architecture.md..."))
-    if src_path.exists():
-        detected_modules = sorted(
-            f.name for f in src_path.glob("*.py") if f.name != "__init__.py" and f.name != "cli.py"
-        )
-    else:
-        detected_modules = REQUIRED_MODULES
-    total += len(detected_modules)
-    arch_docs = architecture_file.read_text() if architecture_file.exists() else ""
-    for module in detected_modules:
-        if check_module_documented(module, arch_docs):
-            click.echo(_("  OK: {module}", module=module))
-        else:
-            click.echo(_("  MISSING: {module}", module=module))
-            missing.append(f"Module: {module}")
-
-    # Check CI scripts in ci-cd-workflow.md
-    # Auto-detect CI scripts from ci/ subdirectory, or use explicit config
-    click.echo(_("\nChecking CI script documentation in ci-cd-workflow.md..."))
-    if ci_scripts_dir is not None:
-        # Explicit config — empty string means skip CI script checks
-        if ci_scripts_dir == "":
-            detected_scripts = []
-        else:
-            ci_dir = Path(ci_scripts_dir)
-            if ci_dir.exists():
-                detected_scripts = sorted(f.name for f in ci_dir.glob("*.py") if f.name != "__init__.py")
-            else:
-                detected_scripts = []
-    else:
-        # Auto-detect from src_path/ci/
-        ci_dir = src_path / "ci" if src_path.name != "ci" else src_path
-        if ci_dir.exists():
-            detected_scripts = sorted(f.name for f in ci_dir.glob("*.py") if f.name != "__init__.py")
-        else:
-            # No ci/ directory found — skip CI script checks rather than falling back
-            # to REQUIRED_SCRIPTS (which is devx-specific)
-            detected_scripts = []
-    total += len(detected_scripts)
-    ci_docs = ci_cd_file.read_text() if ci_cd_file.exists() else ""
-    for script in detected_scripts:
-        if check_module_documented(script, ci_docs):
-            click.echo(_("  OK: {script}", script=script))
-        else:
-            click.echo(_("  MISSING: {script}", script=script))
-            missing.append(f"CI script: {script}")
-
-    # Report
-    covered = total - len(missing)
-    percentage = (covered / total * 100) if total > 0 else 100.0
-    click.echo(
-        _(
-            "\nDoc coverage: {covered}/{total} ({pct}%)",
-            covered=covered,
-            total=total,
-            pct=f"{percentage:.0f}",
-        )
-    )
-
-    if missing:
-        click.echo(_("\nMissing documentation:"))
-        for item in missing:
-            click.echo(f"  - {item}")
-
-    if missing and fail_on_missing:
-        click.echo(_("\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce."))
-        sys.exit(1)
-
-    if not missing:
-        click.echo(_("\nAll documentation coverage checks passed!"))
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,127 +0,0 @@
-#!/usr/bin/env python3
-"""Auto-fix PR title to follow the ``{PREFIX}-N: <title>`` convention.
-
-Reads the task ID from the branch name, fetches the Vikunja task title,
-and updates the PR title via the Gitea API.
-
-Exit codes:
-  0 = PR title updated (or already correct)
-  1 = Error (missing token, PR not found, etc.)
-
-Usage::
-
-    python3 -m devx.ci.fix_pr_title --repo owner/repo --pr-number 123
-    python3 -m devx.ci.fix_pr_title --repo owner/repo --branch DEVX-256-fix-foo --pr-number 123
-"""
-
-from __future__ import annotations
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.api_clients import GiteaClient
-from devx.ci.auto_merge import extract_task_id
-from devx.ci.check_auto_merge_ready import get_vikunja_title_optional
-from devx.config import (
-    GITEA_API_URL,
-    TASK_PREFIX,
-)
-from devx.exceptions import APIError
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-load_dotenv()
-
-
-@click.command()
-@click.option("--repo", required=True, help=_("Repository in owner/name format"))
-@click.option("--pr-number", type=int, required=True, help=_("PR number to fix"))
-@click.option("--branch", default=None, help=_("Branch name (auto-fetched from PR if not given)"))
-@click.option("--dry-run", is_flag=True, help=_("Show what would change without updating"))
-def cli(repo: str, pr_number: int, branch: str | None, dry_run: bool) -> None:
-    """Fix PR title to follow the ``{PREFIX}-N: <title>`` convention."""
-    if "/" not in repo:
-        raise click.ClickException(_("Repo must be in 'owner/name' format, got: {repo}", repo=repo))
-    owner, repo_name = repo.split("/", 1)
-
-    # 1. Get CI token
-    try:
-        token = get_ci_token()
-    except click.ClickException as exc:
-        raise click.ClickException(_("CI_GITEA_API_TOKEN not set: {error}", error=str(exc))) from exc
-
-    client = GiteaClient(GITEA_API_URL, token, owner, repo_name)
-
-    # 2. Fetch PR
-    try:
-        pr = client.get_pr(pr_number)
-    except APIError as exc:
-        raise click.ClickException(_("Failed to fetch PR #{pr}: {error}", pr=pr_number, error=str(exc))) from exc
-
-    current_title = str(pr.get("title", ""))
-    if not branch:
-        branch = str(pr.get("head", {}).get("ref", ""))
-        if not branch:
-            raise click.ClickException(_("Could not determine branch name from PR #{pr}", pr=pr_number))
-
-    click.echo(f"[fix-pr-title] Branch: {branch}")
-    click.echo(f"[fix-pr-title] Current PR title: {current_title}")
-
-    # 3. Extract task ID from branch
-    task_id = extract_task_id(branch)
-    if not task_id:
-        raise click.ClickException(
-            _(
-                "No task ID found in branch '{branch}'. Expected format: {prefix}-N-description.",
-                branch=branch,
-                prefix=TASK_PREFIX,
-            )
-        )
-
-    click.echo(f"[fix-pr-title] Task ID: {task_id}")
-
-    # 4. Get Vikunja task title
-    vikunja_title = get_vikunja_title_optional(task_id)
-    if vikunja_title is None:
-        # Fallback: strip common prefixes from current title
-        # (e.g. "fix: ...", "feat: ...", "refactor: ...")
-        import re
-
-        stripped = re.sub(
-            r"^(fix|feat|refactor|chore|docs|test|ci|build|perf|style|revert)(\(.+?\))?!?:\s*", "", current_title
-        )
-        # Also strip any leading task ID prefix
-        stripped = re.sub(rf"^{TASK_PREFIX}-\d+:\s*", "", stripped)
-        vikunja_title = stripped if stripped else current_title
-        click.echo(f"[fix-pr-title] WARNING: Vikunja task not found — using stripped title: {vikunja_title}")
-    else:
-        click.echo(f"[fix-pr-title] Vikunja title: {vikunja_title}")
-
-    # 5. Build new title
-    # Defensive: strip task ID prefix from Vikunja title if present
-    if vikunja_title.startswith(f"{task_id}:"):
-        vikunja_title = vikunja_title[len(f"{task_id}:") :].strip()
-
-    new_title = f"{task_id}: {vikunja_title}"
-
-    if current_title == new_title:
-        click.echo(f"[fix-pr-title] PR title already correct: {new_title}")
-        return
-
-    click.echo(f"[fix-pr-title] New PR title: {new_title}")
-
-    if dry_run:
-        click.echo("[fix-pr-title] Dry run — not updating PR.")
-        return
-
-    # 6. Update PR title
-    try:
-        client.update_pr(pr_number, {"title": new_title})
-    except APIError as exc:
-        raise click.ClickException(_("Failed to update PR #{pr}: {error}", pr=pr_number, error=str(exc))) from exc
-
-    click.echo(f"[fix-pr-title] PR #{pr_number} title updated to: {new_title}")
-
-
-if __name__ == "__main__":  # pragma: no cover
-    cli()  # pragma: no cover
@@ -1,131 +0,0 @@
-#!/usr/bin/env python3
-"""Run integration tests with cross-runner failure detection.
-
-Wraps ``pytest`` with the same Gitea API polling mechanism used by
-``molecule_ci_guard``. If any other integration-tests matrix runner
-reports failure, the current pytest subprocess is killed and this runner
-exits early with code 1.
-
-Usage::
-
-    python3 -m devx.ci.integration_guard \\
-        -- test_file1.py test_file2.py
-
-    # With pytest options
-    python3 -m devx.ci.integration_guard \\
-        -- -x -v --tb=short test_file1.py
-
-Environment variables:
-    GITEA_URL           Base URL of the Gitea instance.
-    CI_GITEA_API_TOKEN  API token with repo access (CI_GITEA_TOKEN accepted for legacy).
-    RUN_ID              Workflow run ID (GITHUB_RUN_ID).
-    JOB_NAME            Base job name (GITHUB_JOB), e.g. "integration-tests".
-    MATRIX_INDEX        Current matrix index (runner-index).
-    GITEA_REPOSITORY    Repository in "owner/repo" format.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import signal
-import subprocess  # nosec B404
-import sys
-import threading
-import time
-
-import click
-
-from devx.config import REPO_NAME, REPO_OWNER
-from devx.i18n import _
-from devx.molecule.molecule_ci_guard import (
-    poll_for_other_failures,
-)
-from devx.tokens import get_ci_token
-
-POLL_INTERVAL = 10
-
-
-@click.command(context_settings={"ignore_unknown_options": True})
-@click.argument("pytest_args", nargs=-1, type=click.UNPROCESSED, required=True)
-def cli(pytest_args: tuple[str, ...]) -> None:
-    """Run pytest with cross-runner failure detection."""
-    gitea_url = os.environ.get("GITEA_URL", "")
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        token = None
-    run_id = int(os.environ.get("RUN_ID", "0"))
-    job_name = os.environ.get("JOB_NAME", "integration-tests")
-    current_index = int(os.environ.get("MATRIX_INDEX", "0"))
-    repository = os.environ.get("GITEA_REPOSITORY", "")
-    owner, _sep, repo = repository.partition("/")
-    if not owner or not repo:
-        owner, repo = REPO_OWNER, REPO_NAME
-
-    if not all([gitea_url, token, run_id]):
-        click.echo(_("GITEA_URL/CI_GITEA_TOKEN/RUN_ID not set; running without cross-runner cancellation."))
-
-    stop_event = threading.Event()
-    failed_event = threading.Event()
-
-    if gitea_url and token and run_id:
-        poller = threading.Thread(
-            target=poll_for_other_failures,
-            args=(
-                gitea_url,
-                owner,
-                repo,
-                token,
-                run_id,
-                job_name,
-                current_index,
-                stop_event,
-                failed_event,
-            ),
-            daemon=True,
-        )
-        poller.start()
-
-    cmd = [sys.executable, "-m", "pytest"]
-    cmd.extend(pytest_args)
-
-    click.echo(_("Running: {cmd}", cmd=" ".join(cmd)))
-
-    process = subprocess.Popen(  # nosec B603
-        cmd,
-        preexec_fn=os.setsid,
-    )
-
-    try:
-        while process.poll() is None:
-            if failed_event.is_set():
-                with contextlib.suppress(ProcessLookupError):
-                    os.killpg(os.getpgid(process.pid), signal.SIGTERM)
-                try:
-                    process.wait(timeout=10)
-                except subprocess.TimeoutExpired:
-                    with contextlib.suppress(ProcessLookupError):
-                        os.killpg(os.getpgid(process.pid), signal.SIGKILL)
-                    process.wait()
-                click.echo(_("Integration tests cancelled — another runner failed."))
-                sys.exit(1)
-            time.sleep(1)
-    except KeyboardInterrupt:
-        with contextlib.suppress(ProcessLookupError):
-            os.killpg(os.getpgid(process.pid), signal.SIGTERM)
-        process.wait()
-        sys.exit(1)
-    finally:
-        stop_event.set()
-
-    rc = process.returncode
-    if rc != 0:
-        click.echo(_("Integration tests failed with exit code {code}", code=rc))
-    else:
-        click.echo(_("Integration tests passed."))
-    sys.exit(rc)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    cli()
@@ -1,587 +0,0 @@
-#!/usr/bin/env python3
-"""Lint documentation files for structure, links, and quality.
-
-Checks performed (all configurable via pyproject.toml ``[tool.devx.docs]``):
- **Required files**: README.md, AGENTS.md, CHANGELOG.md must exist.
- **Docs structure**: ``docs/index.md`` and ``docs/mapping.json`` must exist.
- **Broken internal links**: relative paths and anchors in markdown files
-  must resolve to actual files and headings.
- **Heading hierarchy**: no skipping heading levels (e.g., ``#`` → ``###``).
- **Single H1**: each markdown file should have at most one H1 heading.
- **Max heading depth**: headings should not exceed H4 (configurable).
- **Max line length**: lines should not exceed 120 characters (configurable).
- **Code block language**: fenced code blocks should specify a language.
- **Orphan docs**: docs not linked from index.md or mapping.json (warning).
- **Mapping completeness**: all docs/*.md should be in mapping.json (warning).
- **TODO/FIXME**: flags leftover TODO/FIXME markers in documentation.
- **Stale docs**: files not modified in >180 days (warning only).
- **Trailing whitespace**: lines should not end with whitespace.
- **Blank line before headings**: headings should have a blank line before them.
-
-Usage::
-
-    python3 -m devx.ci.lint_docs
-    python3 -m devx.ci.lint_docs --docs-dir docs/ --root .
-    python3 -m devx.ci.lint_docs --fix  # auto-fix trailing whitespace
-"""
-
-from __future__ import annotations
-
-import json
-import re
-import sys
-from datetime import datetime, timedelta
-from pathlib import Path
-
-import click
-
-from devx.i18n import _
-
-# Heading slug pattern (GitHub-style)
-_HEADING_RE = re.compile(r"^(#{1,6})\s+(.+?)\s*$", re.MULTILINE)
-# Markdown link pattern: [text](url)
-_LINK_RE = re.compile(r"\[([^\]]*)\]\(([^)]+)\)")
-# Trailing whitespace
-_TRAILING_WS_RE = re.compile(r"[ \t]+$")
-# Heading without blank line before
-_HEADING_NO_BLANK_RE = re.compile(r"([^\n])\n(#{1,6}\s)")
-
-# Files that must exist in every project
-REQUIRED_FILES = ["README.md", "AGENTS.md", "CHANGELOG.md"]
-
-# Files that must exist in docs/
-REQUIRED_DOC_FILES = ["index.md"]
-
-# Maximum age for docs before they're considered stale (days)
-STALE_THRESHOLD_DAYS = 180
-
-# Maximum heading depth (H4 by default)
-MAX_HEADING_DEPTH = 4
-
-# Maximum line length
-MAX_LINE_LENGTH = 120
-
-# Code block without language: ``` followed by optional whitespace only
-_CODE_BLOCK_NO_LANG_RE = re.compile(r"^```[ \t]*$", re.MULTILINE)
-
-# Files excluded from duplicate heading checks (auto-generated or structured
-# with repeated subsections under different parent sections)
-DUPLICATE_HEADING_EXCLUDES = {
-    "CHANGELOG.md",
-    "incident-response-sso.md",
-    "role-sync-design.md",
-}
-
-# TODO/FIXME pattern — matches "TODO:" or "FIXME:" at start of line/after whitespace
-# Does NOT match references to the word "TODO" in rules/documentation
-_TODO_RE = re.compile(r"(?m)^\s*(?:>>>?\s*)?(TODO|FIXME|HACK|XXX)\s*:", re.IGNORECASE)
-
-# Directories excluded from markdown file scanning
-_EXCLUDE_DIRS = {
-    ".venv",
-    ".git",
-    "node_modules",
-    "__pycache__",
-    ".pytest_cache",
-    ".devin",
-    ".terraform",
-    ".vale",
-    "site-packages",
-    "dist-info",
-}
-
-
-def slugify(text: str) -> str:
-    """Convert heading text to a GitHub-style slug."""
-    slug = text.lower().strip()
-    slug = re.sub(r"[^\w\s-]", "", slug)
-    slug = re.sub(r"[\s]+", "-", slug)
-    return slug
-
-
-def strip_code_blocks(content: str) -> str:
-    """Remove fenced code blocks from markdown content.
-
-    Replaces ```...``` blocks with empty lines so heading detection
-    doesn't pick up # comments inside code blocks.
-    """
-    result: list[str] = []
-    in_code_block = False
-    for line in content.splitlines():
-        if line.strip().startswith("```"):
-            in_code_block = not in_code_block
-            result.append("")
-            continue
-        if in_code_block:
-            result.append("")
-            continue
-        result.append(line)
-    return "\n".join(result)
-
-
-def extract_headings(filepath: Path) -> dict[str, int]:
-    """Extract all headings from a markdown file.
-
-    Returns a dict mapping slug → heading level.
-    """
-    content = strip_code_blocks(filepath.read_text(encoding="utf-8"))
-    headings: dict[str, int] = {}
-    for match in _HEADING_RE.finditer(content):
-        level = len(match.group(1))
-        text = match.group(2)
-        slug = slugify(text)
-        headings[slug] = level
-    return headings
-
-
-def extract_links(filepath: Path) -> list[tuple[int, str, str]]:
-    """Extract all markdown links from a file.
-
-    Returns a list of (line_number, link_text, url) tuples.
-    Includes anchor-only links (#section) for validation.
-    Skips external links (http/https) and mailto.
-    """
-    content = filepath.read_text(encoding="utf-8")
-    links: list[tuple[int, str, str]] = []
-    for match in _LINK_RE.finditer(content):
-        url = match.group(2).strip()
-        # Skip external links and mailto
-        if url.startswith(("http://", "https://", "mailto:")):
-            continue
-        line_num = content[: match.start()].count("\n") + 1
-        links.append((line_num, match.group(1), url))
-    return links
-
-
-def check_required_files(root: Path) -> list[str]:
-    """Check that required files exist."""
-    issues: list[str] = []
-    for filename in REQUIRED_FILES:
-        if not (root / filename).exists():
-            issues.append(f"Missing required file: {filename}")
-    return issues
-
-
-def check_docs_structure(root: Path, docs_dir: Path) -> list[str]:
-    """Check that docs directory has required structure."""
-    issues: list[str] = []
-    if not docs_dir.exists():
-        issues.append(f"Docs directory not found: {docs_dir}")
-        return issues
-    for filename in REQUIRED_DOC_FILES:
-        if not (docs_dir / filename).exists():
-            issues.append(f"Missing required doc file: docs/{filename}")
-    mapping_file = docs_dir / "mapping.json"
-    if mapping_file.exists():
-        try:
-            mapping = json.loads(mapping_file.read_text(encoding="utf-8"))
-            if not isinstance(mapping, dict):
-                issues.append("docs/mapping.json must be a JSON object")
-            elif not mapping:
-                issues.append("docs/mapping.json is empty")
-        except json.JSONDecodeError as e:
-            issues.append(f"docs/mapping.json is invalid JSON: {e}")
-    return issues
-
-
-def check_internal_links(root: Path, docs_dir: Path) -> list[str]:
-    """Check that all internal links in markdown files resolve."""
-    issues: list[str] = []
-    md_files = list(root.rglob("*.md"))
-    # Exclude .venv, .git, node_modules
-    md_files = [f for f in md_files if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    # Load wiki page names from mapping.json — these are valid link targets
-    wiki_pages: set[str] = set()
-    mapping_file = docs_dir / "mapping.json"
-    if mapping_file.exists():
-        try:
-            mapping = json.loads(mapping_file.read_text(encoding="utf-8"))
-            wiki_pages = set(mapping.values())
-        except (json.JSONDecodeError, AttributeError):
-            pass
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        links = extract_links(md_file)
-        headings = extract_headings(md_file)
-
-        for line_num, _link_text, url in links:
-            # Split into path and anchor
-            if "#" in url:
-                path_part, anchor = url.split("#", 1)
-            else:
-                path_part, anchor = url, ""
-
-            # Skip wiki page references (no file extension, no /, matches mapping.json values)
-            if path_part and "." not in path_part and "/" not in path_part:
-                if path_part in wiki_pages:
-                    continue
-                # Also skip if it looks like a wiki page name (CamelCase or hyphenated)
-                # without a file extension — can't verify these locally
-                if not any(c in path_part for c in "/\\"):
-                    continue
-
-            # Resolve relative path
-            if path_part:
-                target = (md_file.parent / path_part).resolve()
-                if not target.exists():
-                    issues.append(f"{rel_path}:{line_num}: broken link '{url}' — file not found: {path_part}")
-                    continue
-                # Check anchor in target file
-                if anchor:
-                    target_headings = extract_headings(target)
-                    target_slug = slugify(anchor)
-                    if target_slug not in target_headings:
-                        issues.append(f"{rel_path}:{line_num}: broken anchor '#{anchor}' in {path_part}")
-            elif anchor:
-                # Anchor-only link — check in current file
-                anchor_slug = slugify(anchor)
-                if anchor_slug not in headings:
-                    issues.append(f"{rel_path}:{line_num}: broken anchor '#{anchor}'")
-
-    return issues
-
-
-def check_heading_hierarchy(root: Path) -> list[str]:
-    """Check that headings don't skip levels."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        content = strip_code_blocks(md_file.read_text(encoding="utf-8"))
-        prev_level = 0
-        for match in _HEADING_RE.finditer(content):
-            level = len(match.group(1))
-            if prev_level > 0 and level > prev_level + 1:
-                issues.append(f"{rel_path}: heading hierarchy skip — H{prev_level} → H{level}: '{match.group(2)}'")
-            prev_level = level
-
-    return issues
-
-
-def check_todo_fixme(root: Path) -> list[str]:
-    """Check for TODO/FIXME/HACK/XXX markers in documentation.
-
-    Only flags actual TODO/FIXME markers (e.g., "TODO: fix this"), not
-    references to the word "TODO" in rules or documentation about TODOs.
-    """
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        content = md_file.read_text(encoding="utf-8")
-        for match in _TODO_RE.finditer(content):
-            line_num = content[: match.start()].count("\n") + 1
-            line = content.splitlines()[line_num - 1] if line_num <= len(content.splitlines()) else ""
-            issues.append(f"{rel_path}:{line_num}: TODO/FIXME found: {line.strip()}")
-
-    return issues
-
-
-def check_trailing_whitespace(root: Path) -> list[str]:
-    """Check for trailing whitespace in markdown files."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        content = md_file.read_text(encoding="utf-8")
-        for i, line in enumerate(content.splitlines(), 1):
-            if _TRAILING_WS_RE.search(line):
-                issues.append(f"{rel_path}:{i}: trailing whitespace")
-
-    return issues
-
-
-def check_stale_docs(root: Path) -> list[str]:
-    """Check for stale documentation (not modified in >180 days)."""
-    issues: list[str] = []
-    threshold = datetime.now() - timedelta(days=STALE_THRESHOLD_DAYS)
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        mtime = datetime.fromtimestamp(md_file.stat().st_mtime)
-        if mtime < threshold:
-            days_old = (datetime.now() - mtime).days
-            issues.append(f"{rel_path}: stale doc — not modified in {days_old} days")
-
-    return issues
-
-
-def check_duplicate_headings(root: Path) -> list[str]:
-    """Check for duplicate headings within the same file."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        # Skip auto-generated files like CHANGELOG.md
-        if md_file.name in DUPLICATE_HEADING_EXCLUDES:
-            continue
-        content = strip_code_blocks(md_file.read_text(encoding="utf-8"))
-        seen: dict[str, int] = {}
-        for match in _HEADING_RE.finditer(content):
-            text = match.group(2)
-            slug = slugify(text)
-            if slug in seen:
-                issues.append(f"{rel_path}: duplicate heading '{text}'")
-            seen[slug] = 1
-
-    return issues
-
-
-def check_single_h1(root: Path) -> list[str]:
-    """Check that each markdown file has at most one H1 heading."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        if md_file.name in DUPLICATE_HEADING_EXCLUDES:
-            continue
-        content = strip_code_blocks(md_file.read_text(encoding="utf-8"))
-        h1_count = len(re.findall(r"^#\s+", content, re.MULTILINE))
-        if h1_count > 1:
-            issues.append(f"{rel_path}: {h1_count} H1 headings — should have at most 1")
-
-    return issues
-
-
-def check_max_heading_depth(root: Path) -> list[str]:
-    """Check that headings don't exceed MAX_HEADING_DEPTH."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        content = strip_code_blocks(md_file.read_text(encoding="utf-8"))
-        for match in re.finditer(r"^(#{1,6})\s+", content, re.MULTILINE):
-            level = len(match.group(1))
-            if level > MAX_HEADING_DEPTH:
-                line_num = content[: match.start()].count("\n") + 1
-                issues.append(f"{rel_path}:{line_num}: heading depth H{level} exceeds max H{MAX_HEADING_DEPTH}")
-
-    return issues
-
-
-def check_line_length(root: Path) -> list[str]:
-    """Check that no lines exceed MAX_LINE_LENGTH characters."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        content = md_file.read_text(encoding="utf-8")
-        for i, line in enumerate(content.splitlines(), 1):
-            if len(line) > MAX_LINE_LENGTH:
-                issues.append(f"{rel_path}:{i}: line too long ({len(line)} > {MAX_LINE_LENGTH} chars)")
-
-    return issues
-
-
-def check_code_block_languages(root: Path) -> list[str]:
-    """Check that fenced code blocks specify a language."""
-    issues: list[str] = []
-    md_files = [f for f in root.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-
-    for md_file in md_files:
-        rel_path = md_file.relative_to(root)
-        content = md_file.read_text(encoding="utf-8")
-        in_code_block = False
-        for i, line in enumerate(content.splitlines(), 1):
-            stripped = line.strip()
-            if stripped.startswith("```"):
-                if not in_code_block:
-                    # Opening fence — check for language
-                    if _CODE_BLOCK_NO_LANG_RE.match(line):
-                        issues.append(f"{rel_path}:{i}: code block without language specifier")
-                    in_code_block = True
-                else:
-                    # Closing fence
-                    in_code_block = False
-
-    return issues
-
-
-def check_orphan_docs(root: Path, docs_dir: Path) -> list[str]:
-    """Check for docs not linked from index.md or mapping.json (warnings)."""
-    issues: list[str] = []
-    if not docs_dir.is_dir():
-        return issues
-
-    # Collect all referenced files from index.md and mapping.json
-    referenced: set[str] = set()
-    index_file = docs_dir / "index.md"
-    if index_file.exists():
-        content = index_file.read_text(encoding="utf-8")
-        for match in _LINK_RE.finditer(content):
-            url = match.group(2).strip()
-            if not url.startswith(("http://", "https://", "mailto:")):
-                referenced.add(url.split("#")[0])
-
-    mapping_file = docs_dir / "mapping.json"
-    if mapping_file.exists():
-        try:
-            mapping = json.loads(mapping_file.read_text(encoding="utf-8"))
-            if isinstance(mapping, dict):
-                # Add both keys (filenames) and values (wiki page names)
-                for k, v in mapping.items():
-                    if isinstance(k, str):
-                        referenced.add(k)
-                    if isinstance(v, str):
-                        referenced.add(v)
-        except (json.JSONDecodeError, AttributeError):
-            pass
-
-    # Check each doc file
-    for md_file in sorted(docs_dir.rglob("*.md")):
-        if md_file.name == "index.md":
-            continue
-        rel_path = md_file.relative_to(docs_dir).as_posix()
-        if rel_path not in referenced and md_file.name not in referenced:
-            issues.append(f"docs/{rel_path}: orphan doc — not linked from index.md or mapping.json")
-
-    return issues
-
-
-@click.command()
-@click.option("--root", default=".", help="Repository root directory.")
-@click.option("--docs-dir", default=None, help="Docs directory (default: <root>/docs).")
-@click.option("--check-links/--no-check-links", default=True, help="Check internal links.")
-@click.option("--check-headings/--no-check-headings", default=True, help="Check heading hierarchy.")
-@click.option("--check-todo/--no-check-todo", default=True, help="Check for TODO/FIXME.")
-@click.option("--check-stale/--no-check-stale", default=False, help="Check for stale docs.")
-@click.option("--check-trailing/--no-check-trailing", default=True, help="Check trailing whitespace.")
-@click.option("--check-duplicates/--no-check-duplicates", default=True, help="Check duplicate headings.")
-@click.option("--check-single-h1/--no-check-single-h1", "single_h1", default=True, help="Check single H1 per file.")
-@click.option("--check-depth/--no-check-depth", "depth", default=True, help="Check max heading depth.")
-@click.option("--check-line-length/--no-check-line-length", "line_length", default=True, help="Check line length.")
-@click.option("--check-code-lang/--no-check-code-lang", "code_lang", default=True, help="Check code block languages.")
-@click.option("--check-orphans/--no-check-orphans", "orphans", default=False, help="Check for orphan docs (warnings).")
-@click.option("--fix", is_flag=True, default=False, help="Auto-fix trailing whitespace.")
-def main(
-    root: str,
-    docs_dir: str | None,
-    check_links: bool,
-    check_headings: bool,
-    check_todo: bool,
-    check_stale: bool,
-    check_trailing: bool,
-    check_duplicates: bool,
-    single_h1: bool,
-    depth: bool,
-    line_length: bool,
-    code_lang: bool,
-    orphans: bool,
-    fix: bool,
-) -> None:
-    """Lint documentation files for structure, links, and quality."""
-    root_path = Path(root).resolve()
-    docs_path = Path(docs_dir) if docs_dir else root_path / "docs"
-
-    click.echo(_("Linting documentation in {root}...", root=str(root_path)))
-
-    all_issues: list[str] = []
-
-    # Structure checks
-    click.echo(_("Checking required files..."))
-    all_issues.extend(check_required_files(root_path))
-
-    click.echo(_("Checking docs structure..."))
-    all_issues.extend(check_docs_structure(root_path, docs_path))
-
-    # Link checks
-    if check_links:
-        click.echo(_("Checking internal links..."))
-        all_issues.extend(check_internal_links(root_path, docs_path))
-
-    # Heading hierarchy
-    if check_headings:
-        click.echo(_("Checking heading hierarchy..."))
-        all_issues.extend(check_heading_hierarchy(root_path))
-
-    # Duplicate headings
-    if check_duplicates:
-        click.echo(_("Checking duplicate headings..."))
-        all_issues.extend(check_duplicate_headings(root_path))
-
-    # Single H1
-    if single_h1:
-        click.echo(_("Checking single H1 per file..."))
-        all_issues.extend(check_single_h1(root_path))
-
-    # Max heading depth
-    if depth:
-        click.echo(_("Checking max heading depth..."))
-        all_issues.extend(check_max_heading_depth(root_path))
-
-    # Line length (warnings — badge URLs and tables can exceed 120)
-    if line_length:
-        click.echo(_("Checking line length..."))
-        ll_issues = check_line_length(root_path)
-        for issue in ll_issues[:10]:  # Show first 10 only
-            click.echo(f"  WARN: {issue}")
-        if len(ll_issues) > 10:
-            click.echo(_("  ... and {n} more", n=len(ll_issues) - 10))
-        click.echo(_("  {n} long lines found (warnings only)", n=len(ll_issues)))
-
-    # Code block languages
-    if code_lang:
-        click.echo(_("Checking code block languages..."))
-        all_issues.extend(check_code_block_languages(root_path))
-
-    # TODO/FIXME
-    if check_todo:
-        click.echo(_("Checking for TODO/FIXME markers..."))
-        all_issues.extend(check_todo_fixme(root_path))
-
-    # Trailing whitespace
-    if check_trailing:
-        click.echo(_("Checking trailing whitespace..."))
-        ws_issues = check_trailing_whitespace(root_path)
-        if fix and ws_issues:
-            fixed = 0
-            md_files = [f for f in root_path.rglob("*.md") if not any(part in _EXCLUDE_DIRS for part in f.parts)]
-            for md_file in md_files:
-                content = md_file.read_text(encoding="utf-8")
-                fixed_content = _TRAILING_WS_RE.sub("", content)
-                if content != fixed_content:
-                    md_file.write_text(fixed_content, encoding="utf-8")
-                    fixed += 1
-            click.echo(_("  Auto-fixed trailing whitespace in {n} files", n=fixed))
-        else:
-            all_issues.extend(ws_issues)
-
-    # Stale docs (warnings)
-    if check_stale:
-        click.echo(_("Checking for stale docs..."))
-        stale = check_stale_docs(root_path)
-        for issue in stale:
-            click.echo(f"  WARN: {issue}")
-        click.echo(_("  {n} stale docs found (warnings only)", n=len(stale)))
-
-    # Orphan docs (warnings)
-    if orphans:
-        click.echo(_("Checking for orphan docs..."))
-        orphan_issues = check_orphan_docs(root_path, docs_path)
-        for issue in orphan_issues:
-            click.echo(f"  WARN: {issue}")
-        click.echo(_("  {n} orphan docs found (warnings only)", n=len(orphan_issues)))
-
-    # Report
-    click.echo(f"\n{'=' * 60}")
-    if all_issues:
-        click.echo(_("FAIL: {n} documentation issues found:", n=len(all_issues)))
-        for issue in all_issues:
-            click.echo(f"  - {issue}")
-        sys.exit(1)
-    else:
-        click.echo(_("PASS: All documentation checks passed!"))
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,110 +0,0 @@
-#!/usr/bin/env python3
-"""Create a Gitea issue when a CI workflow fails.
-
-Used by the release and publish workflows to alert on failures that would
-otherwise go unnoticed in the Actions tab. Uses the ``tea`` Gitea CLI
-for issue creation — tea must be installed and configured.
-
-Usage:
-  CI_GITEA_API_TOKEN=<token> python3 -m devx.ci.notify_failure \
-    --repo <owner/repo> \
-    --run-id <run_id> \
-    --workflow <workflow_name> \
-    --commit <commit_sha> \
-    --auto-login
-
-With ``--auto-login``, the script configures the tea CLI login profile
-from the CI API token and ``DEVX_GITEA_API_URL`` before creating the issue,
-eliminating the need for a separate ``tea login add`` step in the workflow.
-"""
-
-from __future__ import annotations
-
-import logging
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.config import GITEA_API_URL
-from devx.gitea_cli import TeaCLI, TeaCLIError, configure_tea_login
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-load_dotenv()
-
-logger = logging.getLogger("devx")
-
-
-def _create_issue_via_tea(repo: str, title: str, body: str) -> int:
-    """Create issue via tea CLI. Returns issue index.
-
-    Raises TeaCLIError if tea is not installed or the command fails.
-    Label operations are best-effort — failures are logged but don't
-    prevent issue creation.
-    """
-    tea = TeaCLI(repo=repo)
-
-    # Check if "bug" label exists (best-effort)
-    labels: list[str] = []
-    try:
-        existing_labels = tea.list_labels(repo)
-        if any(label.get("name") == "bug" for label in existing_labels):
-            labels = ["bug"]
-    except TeaCLIError as e:
-        logger.warning("Could not fetch labels (best-effort): %s", e)
-
-    issue = tea.create_issue(repo, title=title, body=body, labels=labels if labels else None)
-    if labels:
-        try:
-            tea.add_label(repo, issue["index"], labels)
-        except TeaCLIError as e:
-            logger.warning("Could not add label to issue #%s (best-effort): %s", issue.get("index"), e)
-    return int(issue.get("index", 0))
-
-
-@click.command()
-@click.option("--repo", required=True, help="Repository in owner/name format.")
-@click.option("--run-id", required=True, help="CI run ID.")
-@click.option("--workflow", required=True, help="Workflow name.")
-@click.option("--commit", required=True, help="Commit SHA.")
-@click.option(
-    "--auto-login",
-    is_flag=True,
-    default=False,
-    help="Configure tea CLI login from CI_GITEA_TOKEN before creating the issue.",
-)
-def main(repo: str, run_id: str, workflow: str, commit: str, auto_login: bool) -> None:
-    try:
-        get_ci_token()
-    except click.ClickException:
-        raise click.ClickException(_("ERROR: CI_GITEA_TOKEN is not set.")) from None
-
-    if auto_login:
-        configure_tea_login()
-
-    title = f"[CI] {workflow} workflow failed (run #{run_id})"
-    body = (
-        f"The **{workflow}** workflow failed.\n\n"
-        f"- **Run ID**: #{run_id}\n"
-        f"- **Commit**: `{commit[:8]}`\n"
-        f"- **Check the logs**: {GITEA_API_URL.replace('/api/v1', '')}/"
-        f"{repo}/actions/runs/{run_id}\n\n"
-        f"Please investigate and fix the issue."
-    )
-
-    try:
-        issue_id = _create_issue_via_tea(repo, title, body)
-    except TeaCLIError as e:
-        raise click.ClickException(_("Failed to create issue via tea: {error}", error=str(e))) from None
-
-    click.echo(
-        _(
-            "Created issue #{issue_id}: {title}",
-            issue_id=issue_id or "?",
-            title=title,
-        )
-    )
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,199 +0,0 @@
-#!/usr/bin/env python3
-"""Update Vikunja task after a merge to master.
-
-Usage:
-  VIKUNJA_TOKEN=<token> python3 -m devx.ci.post_merge <commit_msg> [--commit-sha <sha>]
-"""
-
-import re
-import subprocess  # nosec B404
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.api_clients import VikunjaClient
-from devx.ci._shared import extract_task_id as _extract_task_id
-from devx.config import DEFAULT_PER_PAGE, TASK_PREFIX, VIKUNJA_API_URL, VIKUNJA_PROJECT_ID
-from devx.exceptions import APIError
-from devx.i18n import _
-from devx.tokens import get_vikunja_token
-
-load_dotenv()
-
-
-def _get_git_commit_message() -> str:
-    """Get the full commit message of the latest commit."""
-    result = subprocess.run(  # nosec B603 B607
-        ["git", "log", "-1", "--pretty=%B"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise click.ClickException(f"git log failed: {result.stderr.strip()}")
-    return result.stdout.strip()
-
-
-def _get_git_commit_sha() -> str:
-    """Get the SHA of the latest commit."""
-    result = subprocess.run(  # nosec B603 B607
-        ["git", "rev-parse", "HEAD"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise click.ClickException(f"git rev-parse failed: {result.stderr.strip()}")
-    return result.stdout.strip()
-
-
-def extract_task_id(commit_msg: str) -> str:
-    """Extract task identifier from the first line of commit message (delegates to shared utility)."""
-    first_line = commit_msg.split("\n")[0]
-    return _extract_task_id(first_line)
-
-
-def extract_conventional_msg(commit_msg: str) -> str:
-    """Strip the DEVX-N prefix from the commit subject.
-
-    Handles both formats:
-    - ``DEVX-N: <message>`` (legacy, colon-separated)
-    - ``DEVX-N <message>`` (current, space-separated)
-    """
-    first_line = commit_msg.split("\n")[0]
-    return re.sub(rf"^{TASK_PREFIX}-\d+[:\s]\s*", "", first_line)
-
-
-def resolve_task_id(client: VikunjaClient, task_id: str) -> int:
-    """Resolve DEVX-N identifier to Vikunja numeric task ID.
-
-    Paginates through the project's tasks to handle projects with more
-    than 50 tasks.  Raises ClickException if the task is not found.
-    """
-    page = 1
-    while True:
-        tasks = client.list_project_tasks(VIKUNJA_PROJECT_ID, page=page, per_page=DEFAULT_PER_PAGE)
-        if not tasks:
-            break
-        matches = [t for t in tasks if t.get("identifier") == task_id]
-        if matches:
-            return int(matches[0]["id"])
-        if len(tasks) < DEFAULT_PER_PAGE:
-            break
-        page += 1
-    raise click.ClickException(
-        _(
-            "Could not find Vikunja task {task_id} in project {project_id}. "
-            "Every PR must have a corresponding Vikunja task.",
-            task_id=task_id,
-            project_id=VIKUNJA_PROJECT_ID,
-        )
-    )
-
-
-def build_comment(task_id: str, conv_msg: str, commit_sha: str) -> str:
-    """Build HTML comment body for Vikunja."""
-    return f"<p><strong>{task_id}</strong>: {conv_msg}</p><p>Commit: <code>{commit_sha}</code></p>"
-
-
-@click.command()
-@click.argument("commit_msg", required=False)
-@click.option("--commit-sha", default="", help="Commit SHA")
-@click.option("--from-git", is_flag=True, default=False, help="Read commit message and SHA from git.")
-@click.option(
-    "--git-sha",
-    default="",
-    help="Read commit message from a specific git SHA (avoids race condition with parallel jobs).",
-)
-def main(commit_msg: str | None, commit_sha: str, from_git: bool, git_sha: str) -> None:
-    if git_sha:
-        # Read commit message from a specific SHA — this avoids the race
-        # condition where a parallel job (e.g., release) pushes a new commit
-        # to master before this job reads HEAD.
-        result = subprocess.run(  # nosec B603 B607
-            ["git", "log", "-1", "--pretty=%B", git_sha],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            raise click.ClickException(f"git log failed for SHA {git_sha}: {result.stderr.strip()}")
-        commit_msg = result.stdout.strip()
-        if not commit_sha:
-            commit_sha = git_sha
-    elif from_git:
-        commit_msg = _get_git_commit_message()
-        if not commit_sha:
-            commit_sha = _get_git_commit_sha()
-    if not commit_msg:
-        raise click.ClickException("commit_msg argument is required (or use --from-git or --git-sha)")
-    try:
-        token = get_vikunja_token()
-    except click.ClickException:
-        raise click.ClickException(_("ERROR: VIKUNJA_TOKEN is not set.")) from None
-
-    task_id = extract_task_id(commit_msg)
-    if not task_id:
-        first_line = commit_msg.split("\n")[0]
-        # Skip gracefully for infrastructure commits that don't follow
-        # the DEVX-N convention: release commits, reverts, bot commits, etc.
-        infra_patterns = [
-            r"^release: v\d+\.\d+\.\d+",  # release commits
-            r"^revert: ",  # git revert commits
-            r"^Merge ",  # merge commits
-            r"^\[skip ci\]",  # skip-ci commits
-        ]
-        for pattern in infra_patterns:
-            if re.match(pattern, first_line):
-                click.echo(
-                    _(
-                        "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}",
-                        msg=first_line,
-                    )
-                )
-                return
-        # Non-infrastructure commits without DEVX-N prefix — this is a
-        # convention violation. Fail the post-merge job so the issue is visible.
-        raise click.ClickException(
-            _(
-                "No task ID ({prefix}-N) found in commit message: {msg}. "
-                "Every non-infrastructure commit must have a task ID.",
-                prefix=TASK_PREFIX,
-                msg=first_line,
-            )
-        )
-
-    client = VikunjaClient(VIKUNJA_API_URL, token)
-    vikunja_task_id = resolve_task_id(client, task_id)
-    conv_msg = extract_conventional_msg(commit_msg)
-    sha = commit_sha or "unknown"
-    html = build_comment(task_id, conv_msg, sha)
-
-    try:
-        client.post_comment(vikunja_task_id, html)
-        client.update_task(vikunja_task_id, done=True)
-    except APIError as e:
-        # Vikunja API failures must be visible — the task was not updated
-        # and needs manual intervention. Failing the CI job makes this visible.
-        raise click.ClickException(
-            _(
-                "Vikunja API error (HTTP {status}): {message}. "
-                "Task {task_id} was NOT updated. "
-                "The merge succeeded but the Vikunja task needs manual update.",
-                status=e.status,
-                message=e.message,
-                task_id=task_id,
-            )
-        ) from e
-
-    click.echo(
-        _(
-            "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.",
-            task_id=task_id,
-            vikunja_id=vikunja_task_id,
-        )
-    )
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,715 +0,0 @@
-#!/usr/bin/env python3
-"""Automated PR review: check architecture compliance, best practices, and quality.
-
-Fetches the PR diff via the Gitea API, runs a series of automated checks,
-and posts a structured review using GiteaClient.create_review.
-
-Checks performed:
-  1. Architecture compliance — no business logic in CLI, no direct subprocess
-     calls outside executor, no hardcoded config that should be in config.py
-  2. Best practices — no bare except, no print() (use click.echo), no TODO/FIXME
-     left in merged code, no functions > 50 lines
-  3. Security — no secrets in code, no shell=True, no eval/exec
-  4. i18n — no raw English strings in click.echo() without _() wrapper
-  5. Resource management — no open() without with statement, no subprocess without cleanup
-  6. Documentation — new CLI commands documented, new modules in architecture.md
-  7. Test coverage — 100% enforced by pytest-cov (checked in quality job)
-  8. Commit conventions — conventional commit format on branch commits
-
-Usage:
-  CI_GITEA_API_TOKEN=<token> [REVIEWER_GITEA_API_TOKEN=<token>] python3 -m devx.ci.pr_review <pr_number> <owner/repo>
-"""
-
-from __future__ import annotations
-
-import os
-import re
-from dataclasses import dataclass, field
-from typing import Any
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.api_clients import GiteaClient
-from devx.config import GITEA_API_URL
-from devx.exceptions import APIError
-from devx.i18n import _
-from devx.tokens import get_ci_token, get_reviewer_token
-
-load_dotenv()
-
-# Files that are exempt from certain checks
-WORKFLOW_ONLY_SUFFIXES = (".yml", ".yaml", ".md", ".json", ".toml", ".cfg", ".ini", ".txt")
-PYTHON_SUFFIX = ".py"
-
-# Architecture rules
-CLI_FILE = "src/devx/cli.py"
-EXECUTOR_FILE = "src/devx/executor.py"
-CONFIG_FILE = "src/devx/config.py"
-
-# Patterns that indicate business logic in CLI (should be in runner_manager.py)
-BUSINESS_LOGIC_IN_CLI = [
-    (r"subprocess\.(run|call|Popen|check_output|check_call)", "subprocess call in CLI — delegate to executor.py"),
-    (r"\bos\.system\b", "os.system call in CLI — delegate to executor.py"),
-    (r"\bansible-playbook\b", "ansible-playbook reference in CLI — delegate to executor.py"),
-]
-
-# Patterns that indicate bad practices
-BAD_PRACTICES = [
-    (r"\bprint\s*\(", "print() found — use click.echo() for user output"),
-    (r"\beval\s*\(", "eval() found — security risk, avoid dynamic code execution"),
-    (r"\bexec\s*\(", "exec() found — security risk, avoid dynamic code execution"),
-    (r"shell\s*=\s*True", "shell=True found — security risk, use shell=False with list args"),
-    (r"except\s*:", "bare except found — catch specific exceptions"),
-    (r"except\s+Exception\s*:", "broad Exception catch — catch specific exceptions"),
-    (r"#\s*(TODO|FIXME|HACK|XXX)", "TODO/FIXME found — resolve before merging"),
-]
-
-# Patterns for hardcoded config values that should be in config.py
-HARDCODED_CONFIG = [
-    (r"https?://[a-z]+\.[a-z]+\.[a-z]+", "hardcoded URL — move to config.py with env var override"),
-]
-
-
-@dataclass
-class ReviewResult:
-    """Result of automated review checks."""
-
-    issues: list[dict[str, Any]] = field(default_factory=list)
-    summary: list[str] = field(default_factory=list)
-
-    @property
-    def has_issues(self) -> bool:
-        return bool(self.issues)
-
-    def add_issue(self, file_path: str, line: int, message: str, severity: str = "warning") -> None:
-        self.issues.append(
-            {
-                "path": file_path,
-                "body": f"[{severity}] {message}",
-                "new_position": line,
-            }
-        )
-
-    def add_summary(self, text: str) -> None:
-        self.summary.append(text)
-
-
-def is_python_file(path: str) -> bool:
-    """Check if a file is a Python source file."""
-    return path.endswith(PYTHON_SUFFIX) and not path.startswith("tests/")
-
-
-def is_workflow_only(path: str) -> bool:
-    """Check if a file is workflow/config/docs only (not Python source)."""
-    return path.endswith(WORKFLOW_ONLY_SUFFIXES) or path.startswith((".gitea/", "docs/", "ansible/"))
-
-
-def check_architecture_compliance(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check that changes follow the documented architecture."""
-    for f in files:
-        path = f.get("filename", "")
-        if not is_python_file(path):
-            continue
-
-        patch = f.get("patch", "")
-        if not patch:
-            continue
-
-        lines = patch.split("\n")
-        current_line = 0
-        for line in lines:
-            if line.startswith("@@"):
-                match = re.search(r"\+(\d+)", line)
-                if match:
-                    current_line = int(match.group(1)) - 1
-                continue
-            if line.startswith("+") and not line.startswith("+++"):
-                current_line += 1
-                content = line[1:]
-
-                # Check for business logic in CLI
-                if path == CLI_FILE:
-                    for pattern, msg in BUSINESS_LOGIC_IN_CLI:
-                        if re.search(pattern, content):
-                            result.add_issue(path, current_line, msg, "error")
-
-    if not result.issues:
-        result.add_summary("- Architecture compliance: OK")
-
-
-def check_best_practices(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check for common code quality issues."""
-    for f in files:
-        path = f.get("filename", "")
-        if not is_python_file(path):
-            continue
-
-        patch = f.get("patch", "")
-        if not patch:
-            continue
-
-        lines = patch.split("\n")
-        current_line = 0
-        for line in lines:
-            if line.startswith("@@"):
-                match = re.search(r"\+(\d+)", line)
-                if match:
-                    current_line = int(match.group(1)) - 1
-                continue
-            if line.startswith("+") and not line.startswith("+++"):
-                current_line += 1
-                content = line[1:]
-
-                for pattern, msg in BAD_PRACTICES:
-                    if re.search(pattern, content):
-                        result.add_issue(path, current_line, msg, "warning")
-
-    if not any(i["body"].startswith("[warning]") for i in result.issues):
-        result.add_summary("- Best practices: OK")
-
-
-def check_security(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check for security issues in changed files."""
-    for f in files:
-        path = f.get("filename", "")
-        if not is_python_file(path):
-            continue
-
-        patch = f.get("patch", "")
-        if not patch:
-            continue
-
-        lines = patch.split("\n")
-        current_line = 0
-        for line in lines:
-            if line.startswith("@@"):
-                match = re.search(r"\+(\d+)", line)
-                if match:
-                    current_line = int(match.group(1)) - 1
-                continue
-            if line.startswith("+") and not line.startswith("+++"):
-                current_line += 1
-                content = line[1:]
-
-                # Check for hardcoded secrets
-                secret_re = r'(token|password|secret|key)\s*=\s*["\'][^"\']{8,}["\']'  # nosec B105
-                is_secret = re.search(secret_re, content, re.IGNORECASE)
-                is_comment = content.strip().startswith("#")
-                is_example = "your-" in content or "example" in content
-                if is_secret and not is_comment and not is_example:
-                    result.add_issue(
-                        path,
-                        current_line,
-                        "potential hardcoded secret — use environment variable",
-                        "error",
-                    )
-
-    if not any(i["body"].startswith("[error]") and "secret" in i["body"] for i in result.issues):
-        result.add_summary("- Security: OK")
-
-
-def check_i18n(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check that user-facing strings are wrapped in _().
-
-    Detects ``click.echo()`` calls with raw string literals that are not
-    wrapped in ``_()``. Only checks ``src/`` files, not tests or scripts.
-    """
-    # Pattern: click.echo("...") or click.echo(f"...") without _() wrapper
-    raw_echo_re = re.compile(r'click\.echo\s*\(\s*["\']([^"\']+)["\']')
-    raw_fstring_re = re.compile(r'click\.echo\s*\(\s*f["\']')
-    # Also check click.ClickException and raise with string
-    raw_exception_re = re.compile(r'click\.ClickException\s*\(\s*["\']([^"\']+)["\']')
-
-    for f in files:
-        path = f.get("filename", "")
-        if not is_python_file(path) or not path.startswith("src/"):
-            continue
-
-        patch = f.get("patch", "")
-        if not patch:
-            continue
-
-        lines = patch.split("\n")
-        current_line = 0
-        for line in lines:
-            if line.startswith("@@"):
-                match = re.search(r"\+(\d+)", line)
-                if match:
-                    current_line = int(match.group(1)) - 1
-                continue
-            if line.startswith("+") and not line.startswith("+++"):
-                current_line += 1
-                content = line[1:]
-
-                # Skip comments and docstrings
-                stripped = content.strip()
-                if stripped.startswith("#") or stripped.startswith('"""') or stripped.startswith("'''"):
-                    continue
-
-                # Check for raw strings in click.echo without _()
-                for regex, msg in [
-                    (raw_echo_re, "click.echo() with raw string — wrap in _() for i18n"),
-                    (raw_fstring_re, "click.echo() with f-string — wrap in _() for i18n"),
-                    (raw_exception_re, "ClickException with raw string — wrap in _() for i18n"),
-                ]:
-                    if regex.search(content):
-                        result.add_issue(path, current_line, msg, "warning")
-
-    if not any("i18n" in i["body"] for i in result.issues):
-        result.add_summary("- i18n: OK")
-
-
-def check_resource_management(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check for resource leaks: open() without with, subprocess without cleanup.
-
-    Detects:
-    - ``open()`` calls not in a ``with`` statement
-    - ``subprocess.Popen()`` without ``.wait()`` or ``.communicate()``
-    """
-    # Pattern: open("...") not preceded by "with" on the same line
-    open_re = re.compile(r"(?<!with\s)\bopen\s*\(")
-    popen_re = re.compile(r"subprocess\.Popen\s*\(")
-
-    for f in files:
-        path = f.get("filename", "")
-        if not is_python_file(path):
-            continue
-
-        patch = f.get("patch", "")
-        if not patch:
-            continue
-
-        lines = patch.split("\n")
-        current_line = 0
-        for line in lines:
-            if line.startswith("@@"):
-                match = re.search(r"\+(\d+)", line)
-                if match:
-                    current_line = int(match.group(1)) - 1
-                continue
-            if line.startswith("+") and not line.startswith("+++"):
-                current_line += 1
-                content = line[1:]
-
-                # Skip comments
-                if content.strip().startswith("#"):
-                    continue
-
-                # Check for open() without with
-                if open_re.search(content) and "with " not in content:
-                    result.add_issue(
-                        path, current_line, "open() without with statement — potential resource leak", "warning"
-                    )
-
-                # Check for Popen without communicate/wait on same line
-                if popen_re.search(content) and ".communicate" not in content and ".wait" not in content:
-                    result.add_issue(
-                        path,
-                        current_line,
-                        "subprocess.Popen() without immediate .communicate() or .wait() — ensure cleanup",
-                        "warning",
-                    )
-
-    if not any("resource" in i["body"].lower() for i in result.issues):
-        result.add_summary("- Resource management: OK")
-
-
-def check_function_length(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check that no new function is excessively long (> 50 lines)."""
-    for f in files:
-        path = f.get("filename", "")
-        if not is_python_file(path):
-            continue
-
-        patch = f.get("patch", "")
-        if not patch:
-            continue
-
-        # Count consecutive added lines within a function
-        lines = patch.split("\n")
-        current_line = 0
-        func_start = 0
-        func_name = ""
-        added_in_func = 0
-
-        for line in lines:
-            if line.startswith("@@"):
-                if func_name and added_in_func > 50:
-                    result.add_issue(
-                        path,
-                        func_start,
-                        f"function '{func_name}' adds {added_in_func} lines — consider splitting (> 50 lines)",
-                        "warning",
-                    )
-                match = re.search(r"\+(\d+)", line)
-                if match:
-                    current_line = int(match.group(1)) - 1
-                func_name = ""
-                added_in_func = 0
-                continue
-            if line.startswith("+") and not line.startswith("+++"):
-                current_line += 1
-                content = line[1:]
-                func_match = re.match(r"\s*def\s+(\w+)\s*\(", content)
-                if func_match:
-                    if func_name and added_in_func > 50:
-                        result.add_issue(
-                            path,
-                            func_start,
-                            f"function '{func_name}' adds {added_in_func} lines — consider splitting (> 50 lines)",
-                            "warning",
-                        )
-                    func_name = func_match.group(1)
-                    func_start = current_line
-                    added_in_func = 0
-                else:
-                    added_in_func += 1
-            elif line.startswith(" ") or line.startswith("-"):
-                pass  # context or removed line
-
-        # Check last function
-        if func_name and added_in_func > 50:
-            result.add_issue(
-                path,
-                func_start,
-                f"function '{func_name}' adds {added_in_func} lines — consider splitting (> 50 lines)",
-                "warning",
-            )
-
-
-def check_documentation(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check that documentation is updated for relevant changes."""
-    has_src_changes = any(
-        is_python_file(f.get("filename", "")) and f.get("filename", "").startswith("src/") for f in files
-    )
-    has_doc_changes = any(
-        f.get("filename", "").startswith("docs/") or f.get("filename", "") in ("README.md", "AGENTS.md", "CHANGELOG.md")
-        for f in files
-    )
-    has_ansible_changes = any(f.get("filename", "").startswith("ansible/") for f in files)
-    has_tofu_changes = any(f.get("filename", "").startswith("tofu/") for f in files)
-    has_workflow_changes = any(f.get("filename", "").startswith(".gitea/") for f in files)
-
-    # Check for TODO/FIXME in changed docs
-    todo_issues: list[str] = []
-    for f in files:
-        filename = f.get("filename", "")
-        if filename.endswith(".md") and filename.startswith(("docs/", "README", "AGENTS")):
-            # Can't check file content from PR API easily, but flag if patch adds TODO
-            patch = f.get("patch", "")
-            if patch and re.search(r"^\+.*\b(TODO|FIXME|HACK|XXX)\b", patch, re.IGNORECASE):
-                todo_issues.append(f"{filename}: new TODO/FIXME added in documentation")
-
-    if has_src_changes and not has_doc_changes:
-        result.add_summary("- Documentation: WARNING — source files changed but no docs updated")
-    elif has_ansible_changes and not has_doc_changes:
-        result.add_summary("- Documentation: WARNING — Ansible role changed but no docs updated")
-    elif has_tofu_changes and not has_doc_changes:
-        result.add_summary("- Documentation: WARNING — OpenTofu changes but no docs updated")
-    elif has_workflow_changes and not has_doc_changes:
-        result.add_summary("- Documentation: INFO — workflow changes (consider updating CI docs if behavior changed)")
-    else:
-        result.add_summary("- Documentation: OK")
-
-    if todo_issues:
-        for issue in todo_issues:
-            result.add_summary(f"- Documentation: WARNING — {issue}")
-
-
-def check_test_coverage(files: list[dict[str, Any]], result: ReviewResult) -> None:
-    """Check that tests are updated for source changes."""
-    has_src_changes = any(
-        is_python_file(f.get("filename", "")) and f.get("filename", "").startswith("src/") for f in files
-    )
-    has_test_changes = any(f.get("filename", "").startswith("tests/") for f in files)
-
-    if has_src_changes and not has_test_changes:
-        result.add_summary("- Tests: WARNING — source files changed but no test files updated")
-    else:
-        result.add_summary("- Tests: OK")
-
-
-def check_commit_conventions(client: GiteaClient, pr_number: str, result: ReviewResult) -> None:
-    """Check that PR commits follow conventional commit format.
-
-    Verifies that at least one commit on the PR branch matches the
-    conventional commit pattern (type: description). Merge commits
-    and revert commits are exempt.
-    """
-    try:
-        commits = client.get_pr_commits(pr_number)
-    except APIError as e:
-        result.add_summary(f"- Commit conventions: ERROR — could not fetch commits: {e.message}")
-        return
-
-    if not commits:
-        result.add_summary("- Commit conventions: OK (no commits to check)")
-        return
-
-    from devx.config import CONVENTIONAL_RE
-
-    has_conventional = False
-    non_conventional: list[str] = []
-
-    for commit in commits:
-        commit_info = commit.get("commit", {})
-        message = str(commit_info.get("message", "") if isinstance(commit_info, dict) else "").split("\n")[0]
-        # Skip merge commits and revert commits
-        if message.startswith(("Merge", "Revert")):
-            continue
-        if CONVENTIONAL_RE.match(message):
-            has_conventional = True
-        else:
-            non_conventional.append(message[:60])
-
-    if has_conventional:
-        result.add_summary("- Commit conventions: OK")
-    elif non_conventional:
-        result.add_summary(
-            f"- Commit conventions: WARNING — no conventional commit found. "
-            f"Non-conventional commits: {', '.join(non_conventional[:3])}"
-        )
-    else:
-        result.add_summary("- Commit conventions: OK (all commits are merges/reverts)")
-
-
-def run_review(client: GiteaClient, pr_number: str) -> ReviewResult:
-    """Run all review checks and return the result."""
-    result = ReviewResult()
-
-    try:
-        files = client.get_pr_files(pr_number)
-    except APIError as e:
-        result.add_summary(f"- ERROR: Could not fetch PR files: {e.message}")
-        return result
-
-    if not files:
-        result.add_summary("- No files changed in this PR")
-        return result
-
-    # Run all checks
-    check_architecture_compliance(files, result)
-    check_best_practices(files, result)
-    check_security(files, result)
-    check_i18n(files, result)
-    check_resource_management(files, result)
-    check_function_length(files, result)
-    check_documentation(files, result)
-    check_test_coverage(files, result)
-    check_commit_conventions(client, pr_number, result)
-
-    return result
-
-
-def build_review_body(result: ReviewResult) -> str:
-    """Build the review body text from the review result."""
-    lines = ["## Automated PR Review", ""]
-
-    for item in result.summary:
-        lines.append(item)
-
-    if result.issues:
-        lines.append("")
-        lines.append(f"**{len(result.issues)} issue(s) found:**")
-        lines.append("")
-        for issue in result.issues:
-            lines.append(f"- `{issue['path']}:{issue['new_position']}` — {issue['body']}")
-    else:
-        lines.append("")
-        lines.append("No issues found by automated checks.")
-
-    lines.append("")
-    lines.append("---")
-    lines.append("**Auto-merge:** If all CI checks pass, this PR will be merged automatically.")
-
-    return "\n".join(lines)
-
-
-def post_review(client: GiteaClient, pr_number: str, result: ReviewResult) -> dict[str, Any]:
-    """Post the review to the PR.
-
-    Uses REQUEST_CHANGES when issues are found, COMMENT otherwise.
-    Never uses APPROVE — the bot shares the PR author's token, so
-    Gitea rejects self-approval. The actual APPROVE must come from
-    the manual review step.
-    """
-    body = build_review_body(result)
-    event = "REQUEST_CHANGES" if result.has_issues else "COMMENT"
-    comments = result.issues if result.has_issues else []
-
-    return client.create_review(pr_number, event=event, body=body, comments=comments)
-
-
-def _post_manual_review(
-    client: GiteaClient,
-    pr_number: str,
-    event: str,
-    body: str | None,
-    checklist_confirmed: bool,
-    checklist_categories: str | None,
-    dry_run: bool,
-    owner: str | None = None,
-    repo_name: str | None = None,
-) -> None:
-    """Post a manual review with validation for APPROVE events.
-
-    When self-approval is rejected (reviewer token belongs to PR author),
-    falls back to the CI token (different user) if available.
-    """
-    if not body or len(body) < 50:
-        raise click.ClickException(_("Review body must be at least 50 characters."))
-
-    if event == "APPROVE":
-        if not checklist_confirmed:
-            raise click.ClickException(
-                _("--checklist-confirmed is required for APPROVE events."),
-            )
-        cats = [c.strip() for c in (checklist_categories or "").split(",") if c.strip()]
-        cat_nums: list[int] = []
-        for c in cats:
-            try:
-                cat_nums.append(int(c))
-            except ValueError:
-                raise click.ClickException(
-                    _("Invalid checklist category: {cat}. Must be numbers.", cat=c),
-                ) from None
-        if len(cat_nums) < 8:
-            raise click.ClickException(
-                _("--checklist-categories must list at least 8 of 13 categories. Got {count}.", count=len(cat_nums)),
-            )
-
-    click.echo(f"Manual review event: {event}")
-    click.echo(f"Body: {body[:80]}...")
-    if checklist_confirmed:
-        click.echo(f"Checklist confirmed: {checklist_categories}")
-
-    if dry_run:
-        click.echo("\n[dry-run] Review not posted.")
-        return
-
-    try:
-        review = client.create_review(pr_number, event=event, body=body)
-    except APIError as e:
-        if "approve" in e.message.lower() or "422" in str(e.status):
-            # Self-approval not allowed (reviewer token belongs to PR author).
-            # Fall back to CI token (different user) if available.
-            ci_token = os.environ.get("CI_GITEA_API_TOKEN", "").strip()
-            if ci_token and owner and repo_name:
-                click.echo(_("Note: Self-approval not allowed with reviewer token. Retrying with CI token."))
-                ci_client = GiteaClient(GITEA_API_URL, ci_token, owner, repo_name)
-                try:
-                    review = ci_client.create_review(pr_number, event=event, body=body)
-                except APIError:
-                    click.echo(_("Note: CI token also cannot approve. Posting COMMENT instead."))
-                    review = client.create_review(pr_number, event="COMMENT", body=body)
-            else:
-                click.echo(_("Note: Self-approval not allowed. Posting COMMENT instead."))
-                review = client.create_review(pr_number, event="COMMENT", body=body)
-        else:
-            raise
-    review_id = review.get("id", "?")
-    click.echo(
-        _(
-            "\nReview #{review_id} posted on PR #{pr_number} with event '{event}'.",
-            review_id=review_id,
-            pr_number=pr_number,
-            event=event,
-        )
-    )
-
-
-@click.command()
-@click.argument("pr_number")
-@click.argument("repo")
-@click.option("--dry-run", is_flag=True, default=False, help="Print review without posting.")
-@click.option(
-    "--event",
-    type=click.Choice(["APPROVE", "REQUEST_CHANGES", "COMMENT"], case_sensitive=False),
-    default=None,
-    help="Post a manual review with the given event (skips automated checks).",
-)
-@click.option("--body", default=None, help="Review body text (required with --event).")
-@click.option(
-    "--checklist-confirmed",
-    is_flag=True,
-    default=False,
-    help="Attest that REVIEW_CHECKLIST.md categories were checked (required for APPROVE).",
-)
-@click.option(
-    "--checklist-categories",
-    default=None,
-    help="Comma-separated checklist category numbers (required for APPROVE, min 8 of 13).",
-)
-def main(
-    pr_number: str,
-    repo: str,
-    dry_run: bool,
-    event: str | None,
-    body: str | None,
-    checklist_confirmed: bool,
-    checklist_categories: str | None,
-) -> None:
-    """Run automated PR review and post results to Gitea.
-
-    Without --event: runs automated checks and posts COMMENT/REQUEST_CHANGES.
-    With --event: posts a manual review (skips automated checks).
-    """
-    try:
-        token = get_reviewer_token() if (event and event.upper() == "APPROVE") else get_ci_token()
-    except click.ClickException:
-        raise click.ClickException(_("ERROR: CI_GITEA_TOKEN is not set.")) from None
-
-    owner, repo_name = repo.split("/")
-    client = GiteaClient(GITEA_API_URL, token, owner, repo_name)
-
-    if event is not None:
-        _post_manual_review(
-            client,
-            pr_number,
-            event.upper(),
-            body,
-            checklist_confirmed,
-            checklist_categories,
-            dry_run,
-            owner=owner,
-            repo_name=repo_name,
-        )
-        return
-
-    result = run_review(client, pr_number)
-
-    body = build_review_body(result)
-    event = "REQUEST_CHANGES" if result.has_issues else "COMMENT"
-
-    click.echo(f"Review event: {event}")
-    click.echo(f"Issues found: {len(result.issues)}")
-    click.echo("")
-    click.echo(body)
-
-    if dry_run:
-        click.echo("\n[dry-run] Review not posted.")
-        return
-
-    try:
-        review = post_review(client, pr_number, result)
-    except APIError as e:
-        if "approve" in e.message.lower() or "422" in str(e.status):
-            click.echo(_("Note: Self-approval not allowed. Posting COMMENT instead."))
-            review = client.create_review(pr_number, event="COMMENT", body=body)
-        else:
-            raise
-    review_id = review.get("id", "?")
-    click.echo(
-        _(
-            "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
-            review_id=review_id,
-            pr_number=pr_number,
-            event=event,
-            num_comments=len(result.issues),
-        )
-    )
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,362 +0,0 @@
-#!/usr/bin/env python3
-"""Build package, optionally publish to PyPI or Gitea PyPI, and create Gitea release.
-
-Uses git-cliff to generate the release notes from conventional commits.
-Uses the ``tea`` Gitea CLI for release creation.
-
-Gitea release creation is retried up to 3 times with exponential backoff
-(2s, 4s) to handle transient failures (network timeouts, 5xx errors).
-If the release already exists, it is treated as success (idempotent).
-
-Publishing destinations (checked in order):
-  1. **Gitea PyPI registry** — if ``--registry-url`` is given (or
-     ``DEVX_PYPI_REGISTRY_URL`` env var is set, or ``GITEA_API_URL``
-     is converted to a packages URL). Uses ``twine upload
-     --repository-url <url> -u <token> -p <token>`` with the
-     CI API token as both username and password.
-  2. **Standard PyPI** — if ``PYPI_TOKEN`` is set. Uses the standard
-     ``twine upload -u __token__ -p <token>`` flow.
-  3. **Skip** — if neither is configured, only the Gitea release is created.
-
-Usage:
-  CI_GITEA_API_TOKEN=<token> [PYPI_TOKEN=<token>] python3 -m devx.ci.publish <tag> <repo>
-  CI_GITEA_API_TOKEN=<token> python3 -m devx.ci.publish <tag> <repo> --registry-url https://git.example.com/api/packages/owner/pypi
-"""
-
-import os
-import shutil
-import subprocess  # nosec B404
-import sys
-from pathlib import Path
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-from tenacity import retry, retry_if_exception_type, stop_after_attempt, wait_exponential
-
-from devx.config import GITEA_API_URL, REPO_OWNER
-from devx.gitea_cli import TeaCLI, TeaCLIError, configure_tea_login
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-load_dotenv()
-
-CLIFF_CONFIG = "cliff.toml"
-
-
-def generate_release_notes(tag: str) -> str:
-    """Generate release notes for the given tag using git-cliff.
-
-    Falls back to a generic message if git-cliff is not available.
-    """
-    cliff_bin = shutil.which("git-cliff")
-    if not cliff_bin:
-        return f"Release {tag}\n\nSee CHANGELOG.md for details."
-    try:
-        result = subprocess.run(  # nosec B603
-            [cliff_bin, "--config", CLIFF_CONFIG, "--latest", "--strip", "header"],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            return result.stdout.strip()
-    except FileNotFoundError:
-        pass
-    return f"Release {tag}\n\nSee CHANGELOG.md for details."
-
-
-def build_package() -> None:
-    """Build the Python package using python -m build."""
-    # Clean dist/ to avoid uploading stale packages from previous builds
-    # (Gitea PyPI returns 409 Conflict for already-published versions).
-    dist_dir = Path("dist")
-    if dist_dir.exists():
-        shutil.rmtree(dist_dir)
-
-    result = subprocess.run(  # nosec B603
-        [sys.executable, "-m", "build"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise click.ClickException(
-            _(
-                "Oops! Package build failed:\n{stderr}",
-                stderr=result.stderr.strip(),
-            )
-        )
-
-
-def publish_to_pypi(token: str) -> None:
-    """Publish built packages to PyPI using twine."""
-    result = subprocess.run(  # nosec B603
-        [
-            sys.executable,
-            "-m",
-            "twine",
-            "upload",
-            "dist/*",
-            "-u",
-            "__token__",
-            "-p",
-            token,
-        ],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise click.ClickException(
-            _(
-                "Oops! PyPI publish failed:\n{stderr}",
-                stderr=result.stderr.strip(),
-            )
-        )
-    click.echo(_("Published to PyPI."))
-
-
-def publish_to_gitea_registry(registry_url: str, token: str) -> None:
-    """Publish built packages to a Gitea PyPI registry using twine.
-
-    Uses the token as both username and password, which is the standard
-    Gitea package authentication method.
-    """
-    result = subprocess.run(  # nosec B603
-        [
-            sys.executable,
-            "-m",
-            "twine",
-            "upload",
-            "dist/*",
-            "--repository-url",
-            registry_url,
-            "-u",
-            token,
-            "-p",
-            token,
-        ],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        # Twine writes errors to stdout (not stderr), so check both.
-        combined = f"{result.stdout}\n{result.stderr}".strip()
-        # 409 Conflict means the package version is already published —
-        # this is not an error, just a sign we're re-running publish.
-        if "409" in combined or "Conflict" in combined:
-            click.echo(_("Gitea PyPI registry: {tag} already published — continuing.", tag=""))
-        else:
-            raise click.ClickException(
-                _(
-                    "Oops! Gitea PyPI registry publish failed:\n{stderr}",
-                    stderr=combined,
-                )
-            )
-    else:
-        click.echo(_("Published to Gitea PyPI registry."))
-
-
-def _default_gitea_registry_url() -> str:
-    """Derive a Gitea PyPI registry URL from GITEA_API_URL.
-
-    Converts e.g. ``https://git.example.com/api/v1`` to
-    ``https://git.example.com/api/packages/<owner>/pypi``.
-    The owner is read from ``DEVX_REPO_OWNER``.
-    """
-    base = GITEA_API_URL.rstrip("/")
-    # Strip /api/v1 or /api suffix to get the base URL
-    if base.endswith("/api/v1"):
-        base = base[: -len("/api/v1")]
-    elif base.endswith("/api"):
-        base = base[: -len("/api")]
-    owner = os.environ.get("DEVX_REPO_OWNER", "") or REPO_OWNER
-    return f"{base}/api/packages/{owner}/pypi"
-
-
-def get_latest_tag() -> str | None:
-    """Get the latest git tag, or None if no tags exist."""
-    try:
-        result = subprocess.run(  # nosec
-            ["git", "describe", "--tags", "--abbrev=0"],
-            capture_output=True,
-            text=True,
-            check=True,
-        )
-        return result.stdout.strip()
-    except subprocess.CalledProcessError:
-        return None
-
-
-def is_release_commit(tag: str) -> bool:
-    """Check if HEAD commit message starts with 'release: <tag>'."""
-    try:
-        result = subprocess.run(  # nosec
-            ["git", "log", "-1", "--format=%s"],
-            capture_output=True,
-            text=True,
-            check=True,
-        )
-        return result.stdout.strip().startswith(f"release: {tag}")
-    except subprocess.CalledProcessError:
-        return False
-
-
-@click.command()
-@click.argument("tag", required=False)
-@click.argument("repo", required=False)
-@click.option(
-    "--registry-url",
-    default=None,
-    help="Gitea PyPI registry URL. Defaults to DEVX_PYPI_REGISTRY_URL env var "
-    "or a URL derived from GITEA_API_URL. When set, publishes to Gitea PyPI "
-    "instead of standard PyPI (unless PYPI_TOKEN is also set).",
-)
-@click.option(
-    "--skip-build",
-    is_flag=True,
-    default=False,
-    help="Skip package build and PyPI publish (for non-Python repos that only "
-    "need a Gitea release with git-cliff notes).",
-)
-@click.option(
-    "--from-tag",
-    is_flag=True,
-    default=False,
-    help="Auto-detect latest tag and check if HEAD is a release commit. "
-    "Skips publish if no tag or HEAD is not a release commit for that tag.",
-)
-@click.option(
-    "--auto-login",
-    is_flag=True,
-    default=False,
-    help="Configure tea CLI login from CI_GITEA_TOKEN before creating the Gitea release. "
-    "Eliminates the need for a separate tea login step in containerized CI jobs.",
-)
-def main(
-    tag: str | None,
-    repo: str | None,
-    registry_url: str | None,
-    skip_build: bool,
-    from_tag: bool,
-    auto_login: bool,
-) -> None:
-    if repo is None:
-        repo = os.environ.get("GITHUB_REPOSITORY", "")
-    if not repo:
-        raise click.ClickException(_("REPO argument is required (or set GITHUB_REPOSITORY env var)."))
-    if from_tag:
-        detected_tag = get_latest_tag()
-        if not detected_tag:
-            click.echo(_("No tag found — skipping publish."))
-            return
-        if not is_release_commit(detected_tag):
-            click.echo(_("HEAD is not a release commit for {tag} — skipping publish.", tag=detected_tag))
-            return
-        tag = detected_tag
-        click.echo(_("Publishing release {tag}...", tag=tag))
-
-    if not tag:
-        raise click.ClickException(_("Tag is required (or use --from-tag)."))
-    try:
-        gitea_token = get_ci_token()
-    except click.ClickException:
-        raise click.ClickException(_("ERROR: CI_GITEA_TOKEN is not set.")) from None
-
-    pypi_token = os.environ.get("PYPI_TOKEN", "")
-
-    # Resolve registry URL: CLI flag > env var > derived from GITEA_API_URL
-    if registry_url is None:
-        registry_url = os.environ.get("DEVX_PYPI_REGISTRY_URL", "")
-    if not registry_url:
-        registry_url = _default_gitea_registry_url()
-
-    if not skip_build:
-        build_package()
-
-        try:
-            if pypi_token:
-                # Standard PyPI flow takes precedence when PYPI_TOKEN is set
-                publish_to_pypi(pypi_token)
-            elif registry_url:
-                # Gitea PyPI registry flow
-                publish_to_gitea_registry(registry_url, gitea_token)
-            else:
-                click.echo(
-                    _(
-                        "PYPI_TOKEN not set and no registry URL configured — "
-                        "skipping PyPI publish. No worries, we'll just create the Gitea release."
-                    )
-                )
-        except click.ClickException as e:
-            click.echo(
-                _(
-                    "PyPI publish failed (non-fatal — continuing to Gitea release):\n{error}",
-                    error=str(e),
-                ),
-                err=True,
-            )
-    else:
-        click.echo(_("--skip-build: skipping package build and PyPI publish."))
-
-    tea = TeaCLI(repo=repo)
-
-    if auto_login:
-        configure_tea_login()
-
-    # Check if release already exists (idempotent — avoids failure when
-    # called multiple times, e.g. by both post-merge and publish workflows)
-    try:
-        releases = tea.list_releases(repo)
-        if any(r.get("tag_name") == tag for r in releases):
-            click.echo(_("Gitea release {tag} already exists — skipping creation.", tag=tag))
-            return
-    except TeaCLIError:
-        pass  # If listing fails, proceed to create
-
-    release_body = generate_release_notes(tag)
-
-    _create_release_with_retry(tea, repo, tag, release_body)
-
-    click.echo(
-        _(
-            "Nice! Gitea release {tag} created.",
-            tag=tag,
-        )
-    )
-
-
-def _create_release_with_retry(tea: TeaCLI, repo: str, tag: str, release_body: str) -> None:
-    """Create a Gitea release with retry for transient failures.
-
-    Retries up to 3 times with exponential backoff (2s, 4s) on TeaCLIError
-    unless the error indicates the release already exists (which is treated
-    as success). This handles transient issues like network timeouts, Gitea
-    rate limiting, or temporary 5xx errors that caused CI run #2822 to fail.
-    """
-
-    @retry(
-        stop=stop_after_attempt(3),
-        wait=wait_exponential(multiplier=2, min=2, max=10),
-        retry=retry_if_exception_type(TeaCLIError),
-        reraise=True,
-    )
-    def _attempt() -> None:
-        try:
-            tea.create_release(repo, tag=tag, title=tag, body=release_body)
-        except TeaCLIError as e:
-            error_str = str(e).lower()
-            if "already" in error_str and "release" in error_str:
-                click.echo(_("Gitea release {tag} already exists — skipping creation.", tag=tag))
-                return
-            raise
-
-    try:
-        _attempt()
-    except TeaCLIError as e:
-        raise click.ClickException(_("Release creation failed: {error}", error=str(e))) from None
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,240 +0,0 @@
-#!/usr/bin/env python3
-"""Generate badge SVG files and push them to the ``badges`` branch.
-
-Also updates README.md and docs/index.md on master with cache-busting
-``raw/commit/<sha>/badge.svg`` URLs so that browsers always fetch the
-latest badge version (Gitea caches ``raw/branch/`` URLs for 6 hours).
-
-The script fetches the latest master before generating badges so that
-the version badge always reflects the current state of the repository
-(even if a release commit was pushed moments before by the parallel
-release job).
-
-Usage::
-
-    python3 -m devx.ci.push_badges
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import re
-import subprocess  # nosec B404
-import sys
-import time
-from pathlib import Path
-from typing import Any
-
-import click
-
-from devx.i18n import _
-
-
-def _repo_root() -> Path:
-    """Resolve repo root from GITHUB_WORKSPACE or cwd."""
-    workspace = os.environ.get("GITHUB_WORKSPACE")
-    if workspace:
-        path = Path(workspace)
-        if path.is_dir():
-            return path
-    return Path.cwd()
-
-
-# Badge filenames that get pushed to the badges branch
-BADGE_FILES = ["coverage.svg", "tests.svg", "docs.svg", "quality.svg", "version.svg", "python.svg"]
-
-# Files that contain badge URLs and need to be updated
-FILES_WITH_BADGE_URLS = ["README.md", "docs/index.md"]
-
-# Pattern to match raw/branch/badges/<name>.svg URLs
-_BADGE_URL_RE = re.compile(r"(https://[^/]+/[^/]+/[^/]+/raw/)(?:branch/badges|commit/[0-9a-f]{40})/([a-z_]+\.svg)")
-
-
-def _run(cmd: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
-    """Run a command and return the result."""
-    return subprocess.run(cmd, check=True, text=True, **kwargs)  # nosec B603
-
-
-def _run_capture(cmd: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
-    """Run a command and capture stdout."""
-    return subprocess.run(cmd, check=True, text=True, capture_output=True, **kwargs)  # nosec B603
-
-
-def fetch_latest_master(branch: str = "master") -> None:
-    """Fetch and hard-reset to the latest remote branch.
-
-    Ensures the working tree reflects the absolute latest state of the
-    remote, which is critical when the release job may have just pushed
-    a new version commit.
-    """
-    _run(["git", "fetch", "origin", branch])  # nosec B607
-    _run(["git", "reset", "--hard", f"origin/{branch}"])  # nosec B607
-    click.echo(_("Synced to latest origin/{branch}", branch=branch))
-
-
-def generate_badges(output_dir: str) -> None:
-    """Generate badge SVG files using devx.tools.generate_badges."""
-    _run([sys.executable, "-m", "devx.tools.generate_badges", "--output-dir", output_dir])
-    badges = list(Path(output_dir).glob("*.svg"))
-    if not badges:
-        raise click.ClickException(_("No badge SVG files generated"))
-    click.echo(_("Generated {count} badge files", count=len(badges)))
-
-
-def push_to_badges_branch(badges_dir: str) -> str:
-    """Push generated badges to the orphan ``badges`` branch.
-
-    Returns the commit SHA of the pushed badges branch.
-    """
-    import shutil
-
-    _run(["git", "config", "user.name", "gitea-actions-bot"])  # nosec B607
-    _run(["git", "config", "user.email", "actions@oblachno.fyi"])  # nosec B607
-    _run(["git", "checkout", "--orphan", "badges"])  # nosec B607
-    _run(["git", "rm", "-rf", "."])  # nosec B607
-    # Remove untracked files/dirs left behind, but preserve .badges/ for copy below
-    _run(["git", "clean", "-fdx", "-e", ".git", "-e", badges_dir])  # nosec B607
-
-    # Copy badge files to root
-    for svg in Path(badges_dir).glob("*.svg"):
-        shutil.copy2(svg, Path.cwd() / svg.name)
-
-    _run(["git", "add", "./*.svg"])  # nosec B607
-    # Commit even if no changes (ensures badges branch always exists)
-    result = _run_capture(["git", "diff", "--cached", "--name-only"])  # nosec B607
-    if result.stdout.strip():
-        _run(["git", "commit", "--no-verify", "-m", "Update badges [skip ci]"])  # nosec B607
-    else:
-        click.echo(_("No badge changes — skipping commit"))
-    _run(["git", "push", "origin", "badges", "--force"])  # nosec B607
-    click.echo(_("Badges pushed to badges branch"))
-
-    # Get the commit SHA of the badges branch
-    result = _run_capture(["git", "rev-parse", "HEAD"])  # nosec B607
-    sha = result.stdout.strip()
-    click.echo(_("Badges commit SHA: {sha}", sha=sha))
-    return sha
-
-
-def update_badge_urls(content: str, badges_sha: str) -> str:
-    """Replace raw/branch/badges/<name>.svg URLs with raw/commit/<sha>/<name>.svg.
-
-    This bypasses Gitea's 6-hour cache on raw/branch/ URLs by using a
-    URL that changes each time the badges branch is updated.
-    """
-    return _BADGE_URL_RE.sub(
-        lambda m: f"{m.group(1)}commit/{badges_sha}/{m.group(2)}",
-        content,
-    )
-
-
-def update_readme_with_badge_sha(badges_sha: str, repo_root: Path | None = None) -> None:
-    """Update README.md and docs/index.md with cache-busting badge URLs.
-
-    Switches back to master, replaces ``raw/branch/badges/`` URLs with
-    ``raw/commit/<sha>/`` URLs, commits and pushes.
-    """
-    root = repo_root or _repo_root()
-
-    # Switch back to master
-    _run(["git", "checkout", "master"])  # nosec B607
-    _run(["git", "fetch", "origin", "master"])  # nosec B607
-    _run(["git", "reset", "--hard", "origin/master"])  # nosec B607
-
-    # Verify version badge matches current __version__
-    from devx.tools.generate_badges import detect_package_name, read_version
-
-    pkg = detect_package_name(root)
-    current_version = read_version(root) if pkg else "unknown"
-    version_svg = Path(".badges") / "version.svg"
-    if version_svg.exists():
-        svg_content = version_svg.read_text()
-        if current_version != "unknown" and f"v{current_version}" not in svg_content:
-            click.echo(
-                _(
-                    "WARNING: Version badge shows stale version (expected v{version}) — regenerating",
-                    version=current_version,
-                )
-            )
-
-    updated_any = False
-    for filename in FILES_WITH_BADGE_URLS:
-        filepath = root / filename
-        if not filepath.exists():
-            continue
-        content = filepath.read_text()
-        new_content = update_badge_urls(content, badges_sha)
-        if new_content != content:
-            filepath.write_text(new_content)
-            click.echo(_("Updated badge URLs in {filename}", filename=filename))
-            updated_any = True
-
-    if not updated_any:
-        click.echo(_("No badge URLs found to update — README already up to date"))
-        return
-
-    _run(["git", "add", "README.md", "docs/index.md"])  # nosec B607
-    _run(
-        [
-            "git",
-            "commit",
-            "--no-verify",
-            "-m",
-            f"chore: update badge URLs to commit {badges_sha[:8]} [skip ci]",
-        ]
-    )  # nosec B607
-    _run(["git", "push", "origin", "master"])  # nosec B607
-    click.echo(_("Pushed README update with badge SHA {sha}", sha=badges_sha[:8]))
-
-
-@click.command()
-@click.option("--output-dir", default=".badges/", help="Temporary directory for badge files.")
-@click.option("--branch", default="master", help="Branch to sync before generating badges.")
-@click.option(
-    "--no-readme-update",
-    is_flag=True,
-    default=False,
-    help="Skip updating README with cache-busting URLs (for local testing).",
-)
-@click.option(
-    "--retries",
-    default=1,
-    type=int,
-    help="Number of attempts on git push failures (default: 1, no retry). "
-    "Between attempts, fetches latest master and waits 10s.",
-)
-def main(output_dir: str, branch: str, no_readme_update: bool, retries: int) -> None:
-    """Generate badges and push them to the badges branch."""
-    last_error: Exception | None = None
-    for attempt in range(1, retries + 1):
-        try:
-            fetch_latest_master(branch)
-            generate_badges(output_dir)
-            badges_sha = push_to_badges_branch(output_dir)
-            if not no_readme_update:
-                update_readme_with_badge_sha(badges_sha)
-            return
-        except (subprocess.CalledProcessError, RuntimeError) as exc:
-            last_error = exc
-            if attempt < retries:
-                click.echo(
-                    _(
-                        "Badge push attempt {attempt}/{retries} failed — retrying: {error}",
-                        attempt=attempt,
-                        retries=retries,
-                        error=exc,
-                    )
-                )
-                time.sleep(10)
-                with contextlib.suppress(subprocess.CalledProcessError):
-                    fetch_latest_master(branch)
-            else:
-                click.echo(_("Badge push failed after {retries} attempts: {error}", retries=retries, error=exc))
-    raise click.ClickException(
-        _("Badge push failed after {retries} attempts: {error}", retries=retries, error=last_error)
-    )
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,48 +0,0 @@
-#!/usr/bin/env python3
-"""Record the deployed git tag for a given environment.
-
-Writes the tag to a Gitea repository variable so it can be queried
-later via the Gitea API or ``devx.ci.get_deployed_tag``.
-
-Usage::
-
-    python -m devx.ci.record_deployed_tag --env production --tag v0.28.1
-    python -m devx.ci.record_deployed_tag --env staging --tag master-abc1234
-"""
-
-from __future__ import annotations
-
-import sys
-
-import click
-
-from devx.api_clients import GiteaClient
-from devx.config import GITEA_API_URL, REPO_NAME, REPO_OWNER
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-
-@click.command()
-@click.option(
-    "--env",
-    "env_name",
-    type=click.Choice(["staging", "production"]),
-    required=True,
-)
-@click.option("--tag", required=True, help=_("Git tag or ref that was deployed"))
-def main(env_name: str, tag: str) -> None:
-    """Record the deployed tag for the given environment."""
-    try:
-        token = get_ci_token()
-    except click.ClickException as exc:
-        click.echo(f"Error: {exc.message}", err=True)
-        sys.exit(1)
-
-    var_name = f"{env_name.upper()}_DEPLOY_TAG"
-    client = GiteaClient(GITEA_API_URL, token, REPO_OWNER, REPO_NAME)
-    client.set_repo_variable(var_name, tag)
-    click.echo(f"Recorded {var_name} = {tag}")
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,799 +0,0 @@
-#!/usr/bin/env python3
-"""Automated release: calculate next version, update files, tag, and push.
-
-Uses git-cliff to determine the next semver version from conventional commits
-since the last tag.  Updates ``__version__`` in ``__init__.py`` (the single
-source of truth, read by setuptools via ``dynamic = ["version"]``) and
-``CHANGELOG.md``, commits them with a ``release:`` prefix, tags the commit
-with the changelog as the tag message, and pushes both to trigger the publish
-workflow.
-
-**Test enforcement**: Before committing or tagging, the script runs
-``make lint-ruff`` and ``make pytest-cov`` to verify the release is healthy.
-If either fails, the release is aborted — no commit, no tag.  This ensures
-we never release a version that fails tests.  Use ``--skip-tests`` only for
-emergency releases (not recommended).
-
-The ``release:`` prefix (instead of ``chore(release):``) keeps the history
-clean while still being descriptive.  Loops are prevented by the
-``has_unreleased_changes`` check — after a release commit is tagged, the next
-run finds no unreleased changes and exits.
-
-This script is idempotent: if there are no new conventional commits since the
-last tag, it exits with a message and does nothing.  If the tag already exists
-(e.g., from a partial previous run), it skips tag creation and only pushes.
-
-**Tag consistency**: Before releasing, the script fetches remote tags and
-verifies all existing tags point to commits whose message matches the tag
-version.  This prevents duplicate release commits (a common issue when CI
-checkouts don't fetch tags) and ensures tag/version/commit alignment.
-
-Usage:
-  CI_GITEA_API_TOKEN=<token> python3 -m devx.ci.release [--dry-run] [--skip-tests]
-  python3 -m devx.ci.release --verify   # Check tag/version/release alignment
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import sys
-import time
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.ci._shared import get_latest_tag, run_cmd, write_github_output
-from devx.ci.classify_changes import has_user_facing_changes  # cross-CI import, needs PYTHONPATH=.
-from devx.i18n import _
-
-load_dotenv()
-
-INIT_FILE = os.getenv("DEVX_VERSION_FILE", "src/devx/__init__.py")
-CHANGELOG_FILE = "CHANGELOG.md"
-CLIFF_CONFIG = "cliff.toml"
-
-
-def tag_exists(tag: str) -> bool:
-    """Check if a git tag already exists."""
-    result = run_cmd(["git", "tag", "-l", tag], check=False)
-    return bool(result.stdout.strip())
-
-
-def get_tag_commit(tag: str) -> str:
-    """Get the commit hash a tag points to."""
-    result = run_cmd(["git", "rev-list", "-n1", tag], check=False)
-    return result.stdout.strip()
-
-
-def get_head_commit() -> str:
-    """Get the current HEAD commit hash."""
-    result = run_cmd(["git", "rev-parse", "HEAD"], check=False)
-    return result.stdout.strip()
-
-
-def fetch_tags() -> None:
-    """Fetch tags from remote to ensure local tag state is current.
-
-    This is critical in CI environments where a fresh checkout may not
-    include tags from previous runs.  Without this, the script may
-    create duplicate release commits because ``tag_exists`` returns False
-    for a tag that exists on the remote but wasn't fetched.
-    """
-    result = run_cmd(["git", "fetch", "--tags", "origin"], check=False)
-    if result.returncode != 0:
-        # Don't fail hard — maybe there's no remote (local-only repo)
-        click.echo(_("Warning: could not fetch tags from origin."))
-
-
-def get_all_tags() -> list[str]:
-    """Get all git tags sorted by version (newest first)."""
-    result = run_cmd(["git", "tag", "-l", "--sort=-v:refname"], check=False)
-    if result.returncode != 0:
-        return []
-    return [t.strip() for t in result.stdout.strip().split("\n") if t.strip()]
-
-
-def get_commit_version(commit: str) -> str | None:
-    """Extract version from a release commit message.
-
-    Returns the version string (e.g., '0.4.4') or None if the commit
-    is not a release commit.
-    """
-    result = run_cmd(["git", "log", "-1", "--pretty=%s", commit], check=False)
-    match = re.match(r"^release: v(\d+\.\d+\.\d+)", result.stdout.strip())
-    return match.group(1) if match else None
-
-
-def verify_tag_consistency() -> list[str]:
-    """Verify all tags point to commits with matching version in message.
-
-    Returns a list of error messages for inconsistent tags.
-    An empty list means all tags are consistent.
-
-    The first release (v0.1.0 or earliest tag) is exempt — initial releases
-    often don't have a "release:" commit message (e.g., the initial commit
-    serves as the first release).
-    """
-    errors: list[str] = []
-    tags = get_all_tags()
-    # Filter to version tags (vX.Y.Z) and sort oldest first
-    version_tags = [t for t in tags if re.match(r"^v\d+\.\d+\.\d+$", t)]
-    sorted_tags = sorted(version_tags, key=lambda t: [int(x) for x in t.lstrip("v").split(".")])
-    first_tag = sorted_tags[0] if sorted_tags else None
-    for tag in tags:
-        # Skip non-version tags (e.g., branch names like "master")
-        if not re.match(r"^v\d+\.\d+\.\d+$", tag):
-            continue
-        tag_version = tag.lstrip("v")
-        commit_version = get_commit_version(tag)
-        if commit_version is None:
-            # First tag is allowed to point to a non-release commit (initial release)
-            if tag == first_tag:
-                continue
-            errors.append(
-                f"  {tag} → points to non-release commit (expected 'release: v{tag_version}', got non-release commit)"
-            )
-        elif commit_version != tag_version:
-            errors.append(f"  {tag} → commit says 'release: v{commit_version}' (expected 'release: v{tag_version}')")
-    return errors
-
-
-def get_bumped_version() -> str:
-    """Use git-cliff to calculate the next version from conventional commits."""
-    result = run_cmd(["git-cliff", "--bumped-version", "--config", CLIFF_CONFIG])
-    version = result.stdout.strip()
-    if not version:
-        raise click.ClickException(_("git-cliff returned empty version."))
-    # git-cliff may return with or without 'v' prefix
-    version = version.lstrip("v")
-    # Validate semver format
-    if not re.match(r"^\d+\.\d+\.\d+$", version):
-        raise click.ClickException(
-            _("git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).", version=version)
-        )
-    return version
-
-
-def get_changelog(new_version: str) -> str:
-    """Generate changelog content for the new version using git-cliff."""
-    result = run_cmd(
-        [
-            "git-cliff",
-            "--config",
-            CLIFF_CONFIG,
-            "--tag",
-            f"v{new_version}",
-            "--unreleased",
-            "--bump",
-        ]
-    )
-    return result.stdout.strip()
-
-
-def has_unreleased_changes(bumped_version: str | None = None) -> bool:
-    """Check if there are unreleased conventional commits since the last tag.
-
-    Uses ``git log`` to check for commits between the last tag and HEAD.
-    This is more reliable than comparing version strings — if git-cliff
-    bumps to the same version (e.g., two fix commits between tags), the
-    version comparison would incorrectly report "no unreleased changes"
-    even though there are commits that haven't been released yet.
-    """
-    latest = get_latest_tag()
-    if not latest:
-        return True
-    # Check for any commits since the last tag, excluding release commits
-    # (release commits themselves are not "unreleased changes" — they ARE
-    # the release).  This prevents duplicate release commits when the
-    # script runs multiple times.
-    result = run_cmd(
-        ["git", "log", f"{latest}..HEAD", "--oneline", "--no-merges", "--invert-grep", "--grep=^release: v"],
-        check=False,
-    )
-    if result.returncode != 0:
-        return False
-    return bool(result.stdout.strip())
-
-
-def update_init_version(new_version: str) -> None:
-    """Update __version__ in __init__.py."""
-    with open(INIT_FILE, encoding="utf-8") as f:
-        content = f.read()
-    if not re.search(r'^__version__\s*=\s*"[^"]*"', content, flags=re.MULTILINE):
-        raise click.ClickException(_("Could not find __version__ in {file}", file=INIT_FILE))
-    updated = re.sub(
-        r'^__version__\s*=\s*"[^"]*"',
-        f'__version__ = "{new_version}"',
-        content,
-        count=1,
-        flags=re.MULTILINE,
-    )
-    with open(INIT_FILE, "w", encoding="utf-8") as f:
-        f.write(updated)
-
-
-def update_changelog(changelog: str) -> None:
-    """Prepend the new changelog section to CHANGELOG.md.
-
-    The changelog from git-cliff may include a header (e.g., "# Changelog").
-    This function strips everything before the first ``## [`` version section
-    before inserting, to avoid duplicating the header.
-    """
-    # Strip git-cliff header — keep only from the first version section
-    section_match = re.search(r"^## \[", changelog, flags=re.MULTILINE)
-    if section_match:
-        changelog = changelog[section_match.start() :]
-
-    try:
-        with open(CHANGELOG_FILE, encoding="utf-8") as f:
-            existing = f.read()
-    except FileNotFoundError:
-        with open(CHANGELOG_FILE, "w", encoding="utf-8") as f:
-            f.write(changelog + "\n")
-        return
-
-    # Find the first version section header (## [...] or ## [unreleased])
-    match = re.search(r"^## \[", existing, flags=re.MULTILINE)
-    if match:
-        # Insert before the first version section
-        pos = match.start()
-        updated = existing[:pos] + changelog + "\n\n" + existing[pos:]
-    else:
-        # No version sections found — append
-        updated = existing.rstrip() + "\n\n" + changelog + "\n"
-    with open(CHANGELOG_FILE, "w", encoding="utf-8") as f:
-        f.write(updated)
-
-
-def update_doc_versions(new_version: str) -> None:
-    """Update documentation version references to match the new release.
-
-    Runs ``check_doc_versions --fix`` so that README.md and docs/*.md
-    always reference the latest released version.
-    """
-    import subprocess  # nosec B404
-
-    result = subprocess.run(  # nosec B603
-        [sys.executable, "-m", "devx.tools.check_doc_versions", "--fix"],
-        check=False,
-        text=True,
-        capture_output=True,
-    )
-    if result.returncode == 0:
-        click.echo(_("Updated documentation version references to v{version}", version=new_version))
-    else:
-        click.echo(
-            _(
-                "WARNING: check_doc_versions --fix failed (rc={rc}): {err}",
-                rc=result.returncode,
-                err=result.stderr.strip()[:200],
-            )
-        )
-
-
-def commit_release_changes(new_version: str) -> bool:
-    """Stage version file and changelog, then create a release commit.
-
-    Uses ``release:`` prefix (not ``chore(release):``) for clarity.
-    The commit is created with ``--no-verify`` to bypass the commit-msg hook
-    (which requires ``DEVX-N:`` prefix for master commits) since release
-    commits are a special case generated by the release script.
-    Returns True if a commit was created, False if there were no staged changes.
-    """
-    run_cmd(["git", "add", INIT_FILE, CHANGELOG_FILE, "README.md", "docs/"])
-    status = run_cmd(["git", "diff", "--cached", "--quiet"], check=False)
-    if status.returncode == 0:
-        click.echo(_("No staged changes — version and changelog already up to date."))
-        return False
-    run_cmd(["git", "commit", "--no-verify", "-m", f"release: v{new_version} [skip ci]"])
-    return True
-
-
-def run_tests() -> None:
-    """Run lint and tests to verify the release is healthy.
-
-    This is called *after* version files are updated but *before* the tag is
-    created, ensuring we never tag a release that fails tests.
-    """
-    click.echo(_("Running lint checks..."))
-    lint = run_cmd(["make", "lint-ruff"], check=False)
-    if lint.returncode != 0:
-        raise click.ClickException(
-            _(
-                "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
-                stderr=lint.stderr.strip() if lint.stderr else lint.stdout.strip(),
-            )
-        )
-    click.echo(_("Lint passed."))
-
-    click.echo(_("Running tests..."))
-    tests = run_cmd(["make", "pytest-cov"], check=False)
-    if tests.returncode != 0:
-        # Print test output for debugging (capture=True hides it otherwise)
-        if tests.stdout:
-            click.echo(tests.stdout)
-        if tests.stderr:
-            click.echo(tests.stderr, err=True)
-        raise click.ClickException(
-            _(
-                "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
-                stderr=tests.stderr.strip() if tests.stderr else tests.stdout.strip(),
-            )
-        )
-    click.echo(_("Tests passed."))
-
-
-def _write_release_tag(tag: str) -> None:
-    """Write the release tag to GITHUB_OUTPUT for downstream jobs.
-
-    This allows a publish job (needs: release) to read the tag via
-    ``${{ needs.release.outputs.tag }}`` instead of relying on
-    tag-push event triggering a separate workflow.
-    """
-    if not os.environ.get("GITHUB_OUTPUT"):
-        return
-    write_github_output("tag", tag)
-    click.echo(_("Wrote tag {tag} to GITHUB_OUTPUT.", tag=tag))
-
-
-def create_and_push_tag(new_version: str, changelog: str, dry_run: bool) -> bool:
-    """Create an annotated tag with the changelog as message and push it.
-
-    Returns True if the tag was created/pushed, False if it already existed.
-    Raises an error if the tag exists but points to a different commit than HEAD.
-    """
-    tag = f"v{new_version}"
-    if tag_exists(tag):
-        # Verify the tag points to HEAD — if it points elsewhere, that's
-        # a consistency error, not a skip condition.
-        tag_commit = get_tag_commit(tag)
-        head_commit = get_head_commit()
-        if tag_commit != head_commit:
-            raise click.ClickException(
-                _(
-                    "Tag {tag} already exists but points to {tag_commit} "
-                    "(expected HEAD {head_commit}). "
-                    "This indicates a tag/commit misalignment. "
-                    "Run 'python3 -m devx.ci.release --verify' for details.",
-                    tag=tag,
-                    tag_commit=tag_commit[:7],
-                    head_commit=head_commit[:7],
-                )
-            )
-        click.echo(_("Tag {tag} already exists and points to HEAD. Skipping creation.", tag=tag))
-        if not dry_run:
-            # Ensure the existing tag is pushed
-            run_cmd(["git", "push", "origin", f"refs/tags/{tag}"], check=False)
-        _write_release_tag(tag)
-        return False
-    tag_msg = f"Release v{new_version}\n\n{changelog}"
-    if dry_run:
-        click.echo(_("[dry-run] Would create tag: {tag}", tag=tag))
-        return True
-    run_cmd(["git", "tag", "-a", tag, "-m", tag_msg])
-    run_cmd(["git", "push", "origin", f"refs/tags/{tag}"])
-    _write_release_tag(tag)
-    return True
-
-
-# ---------------------------------------------------------------------------
-# Verification mode
-# ---------------------------------------------------------------------------
-
-
-def get_init_version() -> str | None:
-    """Read __version__ from the version file."""
-    try:
-        with open(INIT_FILE, encoding="utf-8") as f:
-            content = f.read()
-        match = re.search(r'^__version__\s*=\s*"([^"]*)"', content, flags=re.MULTILINE)
-        return match.group(1) if match else None
-    except FileNotFoundError:
-        return None
-
-
-def get_changelog_versions() -> list[str]:
-    """Extract version numbers from CHANGELOG.md headers, in order."""
-    try:
-        with open(CHANGELOG_FILE, encoding="utf-8") as f:
-            content = f.read()
-        return re.findall(r"^## \[(\d+\.\d+\.\d+)\]", content, flags=re.MULTILINE)
-    except FileNotFoundError:
-        return []
-
-
-def verify_alignment() -> int:
-    """Verify tag/version/changelog alignment. Returns exit code (0=ok, 1=issues)."""
-    click.echo(_("=== Release Alignment Verification ===\n"))
-
-    has_issues = False
-
-    # 1. Check __version__ matches latest tag
-    init_version = get_init_version()
-    latest_tag = get_latest_tag()
-    latest_tag_version = latest_tag.lstrip("v") if latest_tag else None
-
-    click.echo(_("Version file: {file}", file=INIT_FILE))
-    if init_version:
-        click.echo(f'  __version__ = "{init_version}"')
-    else:
-        click.echo("  __version__ = NOT FOUND")
-        has_issues = True
-
-    click.echo(_("\nLatest tag: {tag}", tag=latest_tag or "(none)"))
-    if latest_tag_version and init_version:
-        if latest_tag_version == init_version:
-            click.echo(f"  ✓ Tag version matches __version__ ({init_version})")
-        else:
-            click.echo(f"  ✗ MISMATCH: tag={latest_tag_version}, __version__={init_version}")
-            has_issues = True
-
-    # 2. Check all tags point to commits with matching version
-    click.echo(_("\nTag → Commit alignment:"))
-    tag_errors = verify_tag_consistency()
-    all_tags = get_all_tags()
-    if not all_tags:
-        click.echo("  (no tags)")
-    elif not tag_errors:
-        click.echo(f"  ✓ All {len(all_tags)} tags point to matching release commits")
-    else:
-        has_issues = True
-        for err in tag_errors:
-            click.echo(f"  ✗ {err}")
-
-    # 3. Check CHANGELOG versions are in descending order
-    click.echo(_("\nCHANGELOG version ordering:"))
-    changelog_versions = get_changelog_versions()
-    if not changelog_versions:
-        click.echo("  (no versions in CHANGELOG)")
-    else:
-        # Check for duplicates
-        seen: set[str] = set()
-        duplicates: list[str] = []
-        for v in changelog_versions:
-            if v in seen:
-                duplicates.append(v)
-            seen.add(v)
-
-        # Check ordering (should be descending)
-        is_ordered = all(changelog_versions[i] >= changelog_versions[i + 1] for i in range(len(changelog_versions) - 1))
-
-        if duplicates:
-            has_issues = True
-            click.echo(f"  ✗ Duplicate entries: {', '.join(duplicates)}")
-        elif not is_ordered:
-            has_issues = True
-            click.echo(f"  ✗ Versions not in descending order: {changelog_versions}")
-        else:
-            click.echo(f"  ✓ {len(changelog_versions)} versions, all in descending order")
-
-        # Check latest CHANGELOG version matches latest tag.
-        # The CHANGELOG may have one unreleased section ahead of the latest tag
-        # (e.g., CHANGELOG has 0.6.4 but latest tag is v0.6.3 — 0.6.4 is unreleased).
-        if changelog_versions and latest_tag_version:
-            if changelog_versions[0] == latest_tag_version:
-                click.echo(f"  ✓ Latest CHANGELOG version matches latest tag ({latest_tag_version})")
-            elif latest_tag_version in changelog_versions:
-                tag_idx = changelog_versions.index(latest_tag_version)
-                # Latest tag should be at index 0 or 1 (0 = released, 1 = unreleased ahead)
-                if tag_idx == 1:
-                    click.echo(
-                        f"  ✓ Latest CHANGELOG version ({changelog_versions[0]}) is unreleased, "
-                        f"latest tag is {latest_tag_version}"
-                    )
-                else:
-                    click.echo(
-                        f"  ✗ MISMATCH: CHANGELOG latest={changelog_versions[0]}, "
-                        f"tag={latest_tag_version} (tag is at position {tag_idx})"
-                    )
-                    has_issues = True
-            else:
-                click.echo(f"  ✗ MISMATCH: CHANGELOG latest={changelog_versions[0]}, tag={latest_tag_version}")
-                has_issues = True
-
-    # 4. Check for untagged release commits.
-    # Distinguish between:
-    # - Truly untagged: no tag exists for that version (needs a tag)
-    # - Duplicates: a tag for that version exists but on a different commit
-    #   (historical artifact from buggy release script — informational, not an error)
-    click.echo(_("\nUntagged release commits:"))
-    result = run_cmd(
-        ["git", "log", "--all", "--format=%h %s", "--grep=^release: v"],
-        check=False,
-    )
-    if result.returncode == 0 and result.stdout.strip():
-        all_release_commits = result.stdout.strip().split("\n")
-        all_tags_set = {t.lstrip("v") for t in get_all_tags() if re.match(r"^v\d+\.\d+\.\d+$", t)}
-        truly_untagged: list[str] = []
-        duplicates: list[str] = []
-        for line in all_release_commits:
-            short_hash = line.split()[0]
-            tags_at = run_cmd(["git", "tag", "--points-at", short_hash], check=False)
-            if not tags_at.stdout.strip():
-                # Check if a tag for this version exists elsewhere
-                match = re.search(r"release: v(\d+\.\d+\.\d+)", line)
-                if match and match.group(1) in all_tags_set:
-                    duplicates.append(line)
-                else:
-                    truly_untagged.append(line)
-        if truly_untagged:
-            has_issues = True
-            click.echo(f"  ✗ {len(truly_untagged)} untagged release commits (no tag for version):")
-            for c in truly_untagged[:10]:
-                click.echo(f"    {c}")
-            if len(truly_untagged) > 10:
-                click.echo(f"    ... and {len(truly_untagged) - 10} more")
-        else:
-            click.echo("  ✓ All release commits have tags")
-        if duplicates:
-            click.echo(f"  ℹ {len(duplicates)} duplicate release commits (tag exists on different commit):")
-            for c in duplicates[:5]:
-                click.echo(f"    {c}")
-            if len(duplicates) > 5:
-                click.echo(f"    ... and {len(duplicates) - 5} more")
-    else:
-        click.echo("  (no release commits found)")
-
-    # Summary
-    click.echo(_("\n=== Summary ==="))
-    if has_issues:
-        click.echo("✗ Issues found — see above for details.")
-        return 1
-    click.echo("✓ All checks passed — tags, versions, and changelog are aligned.")
-    return 0
-
-
-# ---------------------------------------------------------------------------
-# Main command
-# ---------------------------------------------------------------------------
-
-
-@click.command()
-@click.option("--dry-run", is_flag=True, default=False, help="Show what would happen without making changes.")
-@click.option(
-    "--skip-tests",
-    is_flag=True,
-    default=False,
-    help="Skip lint and test verification (NOT recommended — only for emergency releases).",
-)
-@click.option(
-    "--verify",
-    is_flag=True,
-    default=False,
-    help="Verify tag/version/changelog alignment and exit (no changes made).",
-)
-def main(dry_run: bool, skip_tests: bool, verify: bool) -> None:
-    """Automated release: calculate next version, update files, tag, and push.
-
-    Use --verify to check tag/version/changelog alignment without making changes.
-    """
-    if verify:
-        sys.exit(verify_alignment())
-
-    # Ensure we're on master (skip this check in dry-run mode for PR validation)
-    branch = run_cmd(["git", "rev-parse", "--abbrev-ref", "HEAD"]).stdout.strip()
-    # Some git versions return "heads/master" instead of "master"
-    branch = branch.removeprefix("heads/")
-    if branch != "master" and not dry_run:
-        raise click.ClickException(_("Release must be run on master, currently on '{branch}'.", branch=branch))
-    if branch != "master" and dry_run:
-        click.echo(
-            _(
-                "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
-                branch=branch,
-            )
-        )
-
-    # Fetch tags from remote to ensure local tag state is current.
-    # This is critical in CI where a fresh checkout may not include tags
-    # from previous runs.  Without this, tag_exists() returns False for
-    # tags that exist on the remote, leading to duplicate release commits.
-    if not dry_run:
-        fetch_tags()
-
-    # Pre-flight: verify existing tags are consistent.  If any tag points
-    # to a commit with a mismatched version, abort before creating more
-    # inconsistencies.
-    tag_errors = verify_tag_consistency()
-    if tag_errors:
-        click.echo(_("ERROR: Tag consistency check failed. Existing tags are misaligned:"))
-        for err in tag_errors:
-            click.echo(err)
-        click.echo(
-            _(
-                "\nFix the misaligned tags before creating new releases. "
-                "Run 'python3 -m devx.ci.release --verify' for a full report."
-            )
-        )
-        raise click.ClickException(_("Tag consistency check failed."))
-
-    # Release lock: if HEAD is already a release commit, check if the tag
-    # exists AND points to HEAD. If the tag is missing (e.g., tag push
-    # failed in a previous run), create and push it. If the tag exists
-    # but points elsewhere, that's an error.
-    head_msg = run_cmd(["git", "log", "-1", "--pretty=%s"]).stdout.strip()
-    release_match = re.match(r"^release: v(\d+\.\d+\.\d+)", head_msg)
-    if release_match:
-        release_version = release_match.group(1)
-        release_tag = f"v{release_version}"
-        if tag_exists(release_tag):
-            tag_commit = get_tag_commit(release_tag)
-            head_commit = get_head_commit()
-            if tag_commit != head_commit:
-                raise click.ClickException(
-                    _(
-                        "HEAD is a release commit for v{version} but tag {tag} "
-                        "points to a different commit ({tag_commit} vs HEAD {head_commit}). "
-                        "This indicates a tag/commit misalignment.",
-                        version=release_version,
-                        tag=release_tag,
-                        tag_commit=tag_commit[:7],
-                        head_commit=head_commit[:7],
-                    )
-                )
-            click.echo(
-                _(
-                    "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
-                    msg=head_msg,
-                    tag=release_tag,
-                )
-            )
-            _write_release_tag(release_tag)
-            return
-        # Tag is missing — recover by creating and pushing it
-        click.echo(
-            _(
-                "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
-                msg=head_msg,
-                tag=release_tag,
-            )
-        )
-        changelog = get_changelog(release_version)
-        create_and_push_tag(release_version, changelog, dry_run)
-        return
-
-    # Check if any user-facing files changed since the last tag.
-    # If only workflow/infra files changed, skip the release entirely.
-    latest_tag = get_latest_tag()
-    if latest_tag and not has_user_facing_changes(latest_tag, "HEAD"):
-        click.echo(
-            _(
-                "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
-                tag=latest_tag,
-            )
-        )
-        return
-
-    # Calculate next version (single git-cliff call — Gap 7 fix)
-    new_version = get_bumped_version()
-
-    # Check for unreleased changes (reuses the version we just calculated)
-    if not has_unreleased_changes(bumped_version=new_version):
-        click.echo(_("No unreleased changes found. Nothing to release."))
-        return
-
-    current_tag = get_latest_tag()
-    # If the bumped version equals the current tag version, there's nothing
-    # new to release. git-cliff didn't bump because the commits since the last
-    # tag don't warrant a version change (e.g., only ci:/chore: commits).
-    # Creating a release commit with the same version would cause a tag
-    # conflict.
-    if current_tag and current_tag.lstrip("v") == new_version:
-        click.echo(
-            _(
-                "Version stays at v{version} — no version bump from git-cliff. "
-                "Commits since last tag don't warrant a new release. Skipping.",
-                version=new_version,
-            )
-        )
-        return
-    click.echo(
-        _(
-            "Bumping version: {current} -> v{new_version}",
-            current=current_tag or "(none)",
-            new_version=new_version,
-        )
-    )
-
-    # Generate changelog
-    changelog = get_changelog(new_version)
-    if not changelog:
-        raise click.ClickException(
-            _(
-                "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
-                version=new_version,
-            )
-        )
-
-    if dry_run:
-        click.echo(_("\n[dry-run] Changelog:\n{changelog}", changelog=changelog))
-        click.echo(_("[dry-run] Would update {init}", init=INIT_FILE))
-        click.echo(_("[dry-run] Would update {changelog_file}", changelog_file=CHANGELOG_FILE))
-        click.echo(_("[dry-run] Would update doc version references via check_doc_versions --fix"))
-        click.echo(_("[dry-run] Would commit: release: v{version} [skip ci]", version=new_version))
-        click.echo(_("[dry-run] Would push commit to master"))
-        click.echo(_("[dry-run] Would create tag: v{version}", version=new_version))
-        return
-
-    # Update version file
-    update_init_version(new_version)
-    click.echo(_("Updated version in {init}", init=INIT_FILE))
-
-    # Update CHANGELOG.md (Gap 3 fix)
-    update_changelog(changelog)
-    click.echo(_("Updated {changelog_file}", changelog_file=CHANGELOG_FILE))
-
-    # Update documentation version references (README, docs/*.md)
-    update_doc_versions(new_version)
-
-    # Verify tests pass BEFORE committing or tagging.
-    # This ensures we never release a version that fails tests.
-    if skip_tests:
-        click.echo(_("WARNING: --skip-tests passed — skipping test verification."))
-    else:
-        run_tests()
-
-    # Commit version + changelog (Gap 11: use 'release:' prefix, not 'chore(release):')
-    committed = commit_release_changes(new_version)
-    if committed:
-        click.echo(_("Created release commit."))
-        # Pull --rebase before push to handle the case where master
-        # advanced between checkout and commit (e.g., another merge).
-        # Retry up to 3 times to handle concurrent pushes.
-        push_succeeded = False
-        for attempt in range(3):
-            rebase = run_cmd(["git", "pull", "--rebase", "origin", "master"], check=False)
-            if rebase.returncode != 0:
-                # Rebase failed (likely conflicts). Abort and retry.
-                click.echo(
-                    _(
-                        "Rebase attempt {n}/3 failed: {err}",
-                        n=attempt + 1,
-                        err=rebase.stderr.strip() if rebase.stderr else rebase.stdout.strip(),
-                    )
-                )
-                run_cmd(["git", "rebase", "--abort"], check=False)
-                # Brief delay before retry to let concurrent pushes settle.
-                time.sleep(5)
-                continue
-            push = run_cmd(["git", "push", "origin", "refs/heads/master:refs/heads/master"], check=False)
-            if push.returncode == 0:
-                push_succeeded = True
-                break
-            click.echo(
-                _(
-                    "Push attempt {n}/3 failed: {err}",
-                    n=attempt + 1,
-                    err=push.stderr.strip() if push.stderr else push.stdout.strip(),
-                )
-            )
-            time.sleep(5)
-        if not push_succeeded:
-            raise click.ClickException(
-                _("Failed to push release commit after 3 attempts. Manual intervention required.")
-            )
-        click.echo(_("Pushed release commit to master."))
-    else:
-        click.echo(_("Skipping commit push — no staged changes."))
-
-    # Create and push tag (Gap 4: handles existing tag)
-    created = create_and_push_tag(new_version, changelog, dry_run)
-    if created:
-        click.echo(
-            _(
-                "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
-                version=new_version,
-            )
-        )
-    else:
-        click.echo(
-            _(
-                "Tag v{version} already existed. Publish workflow should already have been triggered.",
-                version=new_version,
-            )
-        )
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
@@ -1,356 +0,0 @@
-#!/usr/bin/env python3
-"""Sync documentation from /docs/ to the Gitea wiki via Git.
-
-Instead of using the Gitea wiki API (which is slow, unreliable, and
-prone to timeouts), this module clones the wiki Git repository,
-copies the documentation files into it, transforms internal links
-to wiki-friendly format, commits, and pushes.
-
-This approach is:
- **Faster** — a single git push vs N API calls
- **More reliable** — no API timeouts or rate limits
- **Atomic** — all pages sync in one commit
- **Auto-pruning** — stale wiki pages are removed automatically
-
-The wiki Git URL is ``{clone_url}.wiki.git`` (Gitea convention).
-
-Link transformations:
- ``[text](file.md)`` → ``[text](file)`` (wiki pages don't use .md)
- ``[text](docs/file.md)`` → ``[text](file)``
- External links (http/https/mailto) are preserved
- Anchor-only links (``#section``) are preserved
-
-Usage:
-  CI_GITEA_API_TOKEN=<token> python3 -m devx.ci.sync_wiki [--dry-run] [--repo owner/repo]
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-import subprocess  # nosec B404
-import tempfile
-import time
-from pathlib import Path
-from urllib.parse import quote, urlparse
-
-import click
-from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
-
-from devx.config import GITEA_API_URL, REPO_NAME, REPO_OWNER
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-load_dotenv()
-
-DOCS_DIR = Path(os.environ.get("DEVX_DOCS_DIR", "docs"))
-MAPPING_FILE = DOCS_DIR / "mapping.json"
-
-# Markdown link pattern: [text](url)
-_LINK_RE = re.compile(r"\[([^\]]*)\]\(([^)]+)\)")
-
-
-def wiki_filename(page_title: str) -> str:
-    """Convert a wiki page title to its Gitea wiki filename.
-
-    Gitea uses a "dash marker" (``.-``) suffix to distinguish literal dashes
-    from space-to-dash conversions.  See Gitea's ``services/wiki/wiki_path.go``.
-
-    - "Architecture" (no dashes) → ``Architecture.md``
-    - "Getting-Started" (has dashes) → ``Getting-Started.-.md``
-    - "Home" (no dashes) → ``Home.md``
-    """
-    name = page_title.replace(" ", "-")
-    if "-" in name:
-        name += ".-"
-    name += ".md"
-    return quote(name, safe="")
-
-
-def load_mapping() -> dict[str, str]:
-    """Load the file-to-wiki-page mapping from mapping.json."""
-    with open(MAPPING_FILE, encoding="utf-8") as f:
-        data = json.load(f)
-    if not isinstance(data, dict):
-        raise click.ClickException(
-            _("mapping.json must be a dict of file-path -> page-title, got {type}", type=type(data).__name__)
-        )
-    for k, v in data.items():
-        if not isinstance(k, str) or not isinstance(v, str):
-            raise click.ClickException(_("mapping.json keys and values must be strings, got {k}={v}", k=k, v=v))
-    return data
-
-
-def transform_links(content: str) -> str:
-    """Transform markdown links from file-based to wiki-friendly format.
-
-    - ``[text](file.md)`` → ``[text](file)``
-    - ``[text](docs/file.md)`` → ``[text](file)``
-    - ``[text](../file.md)`` → ``[text](file)``
-    - External links (http/https/mailto) preserved
-    - Anchor-only links (``#section``) preserved
-    """
-
-    def replace_link(match: re.Match[str]) -> str:
-        text = match.group(1)
-        url = match.group(2).strip()
-        # Skip external links and mailto
-        if url.startswith(("http://", "https://", "mailto:")):
-            return match.group(0)
-        # Skip anchor-only links
-        if url.startswith("#"):
-            return match.group(0)
-        # Split path and anchor
-        if "#" in url:
-            path_part, anchor = url.split("#", 1)
-            anchor = f"#{anchor}"
-        else:
-            path_part, anchor = url, ""
-        # Remove .md extension and directory prefixes
-        if path_part.endswith(".md"):
-            path_part = path_part[:-3]
-        # Remove directory prefix (docs/, ../, etc.)
-        path_part = path_part.split("/")[-1]
-        return f"[{text}]({path_part}{anchor})"
-
-    return _LINK_RE.sub(replace_link, content)
-
-
-def get_wiki_clone_url(owner: str, repo: str, token: str) -> str:
-    """Build the wiki Git clone URL with token auth."""
-    # Gitea wiki repos are at {clone_url}.wiki.git
-    # Extract base URL from API URL
-    base = GITEA_API_URL.rsplit("/api/v1", 1)[0]
-    # Embed token in URL for both clone and push auth
-    # Format: https://token@host/owner/repo.wiki.git
-    parsed = urlparse(base)
-    return f"{parsed.scheme}://{token}@{parsed.hostname}/{owner}/{repo}.wiki.git"
-
-
-def clone_wiki(wiki_url: str, dest: Path) -> bool:
-    """Clone the wiki repo into dest. Returns True if clone succeeded.
-
-    If the wiki repo doesn't exist yet (no pages created), returns False.
-    """
-    result = subprocess.run(  # nosec
-        ["git", "clone", "--depth", "1", wiki_url, str(dest)],
-        capture_output=True,
-        text=True,
-        timeout=60,
-    )
-    return result.returncode == 0
-
-
-def init_wiki(dest: Path) -> None:
-    """Initialize a fresh wiki repo (when clone fails)."""
-    dest.mkdir(parents=True, exist_ok=True)
-    subprocess.run(["git", "init"], cwd=dest, capture_output=True, check=True)  # nosec
-    subprocess.run(  # nosec
-        ["git", "config", "user.email", "ci@oblachno.fyi"],
-        cwd=dest,
-        capture_output=True,
-        check=True,
-    )
-    subprocess.run(  # nosec
-        ["git", "config", "user.name", "CI Wiki Sync"],
-        cwd=dest,
-        capture_output=True,
-        check=True,
-    )
-
-
-def sync_files(
-    docs_dir: Path,
-    wiki_dir: Path,
-    mapping: dict[str, str],
-    dry_run: bool,
-) -> tuple[int, int]:
-    """Copy docs files to wiki dir with link transformation.
-
-    Returns (synced, pruned) counts.
-    """
-    synced = 0
-
-    # Build set of expected wiki filenames
-    expected_files: set[str] = set()
-
-    for file_path, page_title in sorted(mapping.items()):
-        src = docs_dir / file_path
-        if not src.exists():
-            click.echo(_("  WARN: Mapped file {file} not found, skipping", file=file_path))
-            continue
-
-        content = src.read_text(encoding="utf-8")
-        if not content.strip():
-            click.echo(_("  WARN: Mapped file {file} is empty, skipping", file=file_path))
-            continue
-
-        # Transform links
-        transformed = transform_links(content)
-
-        # Wiki filename: Gitea uses a dash-marker convention for titles with dashes
-        fname = wiki_filename(page_title)
-        expected_files.add(fname)
-
-        if not dry_run:
-            dest = wiki_dir / fname
-            dest.write_text(transformed, encoding="utf-8")
-        synced += 1
-        click.echo(_("  Synced: {title} → {file}", title=page_title, file=fname))
-
-    # Prune stale pages (in wiki but not in mapping)
-    pruned = 0
-    if not dry_run:
-        for existing in wiki_dir.glob("*.md"):
-            if existing.name not in expected_files:
-                existing.unlink()
-                pruned += 1
-                click.echo(_("  Pruned: {file} (not in mapping)", file=existing.name))
-
-    return synced, pruned
-
-
-def commit_and_push(wiki_dir: Path, wiki_url: str, dry_run: bool) -> bool:
-    """Commit changes and push to the wiki repo. Returns True if pushed."""
-    if dry_run:
-        click.echo(_("[dry-run] Would commit and push wiki changes"))
-        return False
-
-    # Stage all changes
-    subprocess.run(["git", "add", "-A"], cwd=wiki_dir, capture_output=True, check=True)  # nosec
-
-    # Check if there are changes to commit
-    result = subprocess.run(  # nosec
-        ["git", "diff", "--cached", "--quiet"],
-        cwd=wiki_dir,
-        capture_output=True,
-    )
-    if result.returncode == 0:
-        click.echo(_("No changes to sync — wiki is up to date."))
-        return False
-
-    # Commit — ensure git identity is configured (CI environments may lack it)
-    subprocess.run(  # nosec
-        ["git", "config", "user.email", "devin-ai-integration[bot]@users.noreply.github.com"],
-        cwd=wiki_dir,
-        capture_output=True,
-        check=True,
-    )
-    subprocess.run(  # nosec
-        ["git", "config", "user.name", "Devin CI"],
-        cwd=wiki_dir,
-        capture_output=True,
-        check=True,
-    )
-    subprocess.run(  # nosec
-        ["git", "commit", "-m", "Sync wiki from docs/ [skip ci]"],
-        cwd=wiki_dir,
-        capture_output=True,
-        check=True,
-    )
-
-    # Push
-    result = subprocess.run(  # nosec
-        ["git", "push", "--force", wiki_url, "HEAD:main"],
-        cwd=wiki_dir,
-        capture_output=True,
-        text=True,
-        timeout=60,
-    )
-    if result.returncode != 0:
-        click.echo(_("Push failed: {error}", error=result.stderr))
-        return False
-    return True
-
-
-@click.command()
-@click.option("--dry-run", is_flag=True, default=False, help="Show what would happen without making changes.")
-@click.option("--repo", default=None, help="Repository in owner/name format (auto-detected if omitted).")
-@click.option(
-    "--verify",
-    is_flag=True,
-    default=False,
-    help="After syncing, verify each page exists in the wiki. Exit 1 if any page is missing.",
-)
-def main(dry_run: bool, repo: str | None, verify: bool) -> None:
-    """Sync documentation to the Gitea wiki via Git."""
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        raise click.ClickException(_("ERROR: CI_GITEA_TOKEN is not set.")) from None
-
-    if repo is None:
-        owner = os.environ.get("DEVX_REPO_OWNER", "") or REPO_OWNER
-        repo_name = os.environ.get("DEVX_REPO_NAME", "") or REPO_NAME
-    else:
-        owner, repo_name = repo.split("/")
-
-    if not MAPPING_FILE.exists():
-        raise click.ClickException(_("ERROR: mapping.json not found at {path}", path=MAPPING_FILE))
-
-    mapping = load_mapping()
-    wiki_url = get_wiki_clone_url(owner, repo_name, token)
-
-    click.echo(_("Syncing {count} documentation pages to wiki via Git...", count=len(mapping)))
-
-    with tempfile.TemporaryDirectory() as tmpdir:
-        wiki_dir = Path(tmpdir) / "wiki"
-
-        click.echo(_("Cloning wiki repo..."))
-        if clone_wiki(wiki_url, wiki_dir):
-            click.echo(_("Cloned existing wiki."))
-        else:
-            click.echo(_("Wiki repo not found or empty — initializing fresh."))
-            init_wiki(wiki_dir)
-
-        click.echo(_("Syncing files..."))
-        synced, pruned = sync_files(DOCS_DIR, wiki_dir, mapping, dry_run)
-
-        click.echo(
-            _(
-                "\nDone! Synced: {synced}, Pruned: {pruned}",
-                synced=synced,
-                pruned=pruned,
-            )
-        )
-
-        if dry_run:
-            click.echo(_("[dry-run] No changes pushed."))
-            return
-
-        click.echo(_("Committing and pushing..."))
-        pushed = commit_and_push(wiki_dir, wiki_url, dry_run)
-        if pushed:
-            click.echo(_("Wiki synced successfully."))
-        elif not dry_run:
-            click.echo(_("No push needed (no changes or push failed)."))
-
-        # Verification
-        if verify and not dry_run:
-            if pushed:
-                click.echo(_("Waiting 5s for Gitea to process pushed commits..."))
-                time.sleep(5)
-            click.echo(_("\nVerifying wiki pages..."))
-            # Re-clone to verify
-            verify_dir = Path(tmpdir) / "verify"
-            if not clone_wiki(wiki_url, verify_dir):
-                click.echo(_("FAIL: Could not clone wiki for verification."))
-                raise click.ClickException(_("Wiki verification failed — could not clone wiki"))
-            failures = 0
-            for _file_path, page_title in sorted(mapping.items()):
-                fname = wiki_filename(page_title)
-                if (verify_dir / fname).exists():
-                    click.echo(_("  OK: {title}", title=page_title))
-                else:
-                    click.echo(_("  FAIL: {title} — page not found in wiki!", title=page_title))
-                    failures += 1
-            if failures > 0:
-                raise click.ClickException(
-                    _("Wiki verification failed — {failures} page(s) missing", failures=failures)
-                )
-            click.echo(_("\nVerification passed — all wiki pages exist."))
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()
--- a/Show More
+++ b/Show More