chore: update badge URLs to commit 09be7662 [skip ci]

DEVX-167: docs: add dependency-graph, deployment-coordination, and skill-creation skills
Co-authored-by: emil User <emil.simeonov@tutanota.com>
2026-09-05 14:18:15 +00:00 · 2026-09-05 14:16:52 +00:00 · 2026-08-26 18:12:15 +00:00 · 2026-08-26 18:11:18 +00:00 · 2026-08-26 18:10:34 +00:00 · 2026-08-26 18:06:00 +00:00
28 changed files with 1043 additions and 677 deletions
@@ -0,0 +1,135 @@
+# dependency-graph
+
+Map of the oblachno ecosystem. Knows which repo produces what, which
+repos depend on which, and the correct order for cross-repo changes.
+
+## When to Invoke
+
+Invoke this skill when:
+- Changes span multiple repos
+- A change in one repo requires version bumps in downstream repos
+- Deploying infrastructure that depends on published packages/images
+- Verifying the ecosystem is in a consistent state before deployment
+- Determining which repos to update and in what order
+
+## Prerequisites
+
+- All repos cloned under `/home/emo/dev/ideas/oblachno/`
+- `.env` with `DEVELOPER_GITEA_API_TOKEN` in each repo
+
+## Ecosystem Map
+
+```
+                    devx (PyPI package)
+                   /    |    \
+                  /     |     \
+            grm   sso-bridge   infra
+           (PyPI)  (PyPI+Docker) (deploys all)
+              |        |           |
+              v        v           v
+         infra bump  infra bump   staging
+         (auto PR)   (auto PR)   production
+                                      |
+                          mattermost-oidc (Docker image)
+                          (infra pulls :latest at deploy)
+```
+
+## Repositories
+
+| Repo | Produces | Consumers | Release Trigger |
+|------|----------|-----------|-----------------|
+| `devx` | PyPI package `devx` | grm, sso-bridge, infra | User-facing changes to `src/devx/**` |
+| `grm` | PyPI package `grm` | infra | User-facing changes to `src/grm/**` or `ansible/**` |
+| `sso-bridge` | PyPI package `sso_bridge` + Docker image | infra | User-facing changes to `src/sso_bridge/**` or `ansible/**` |
+| `infra` | Staging/production deployment | (end users) | User-facing changes + nightly gate |
+| `mattermost-oidc` | Docker image `mattermost-oidc` | infra (pulls at deploy) | `Dockerfile` or `build.yml` changes |
+
+## Dependency Chain
+
+### devx → all repos
+
+devx publishes to the Gitea PyPI registry. grm, sso-bridge, and infra
+pin devx in `pyproject.toml`:
+```toml
+"devx @ git+https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git@vX.Y.Z"
+```
+
+When devx publishes a new version:
+1. grm, sso-bridge, and infra must bump their pinned devx version
+2. This is currently manual — no auto-dependency-PR from devx
+3. Each repo must `make setup` to pick up the new version
+
+### grm → infra
+
+grm publishes to PyPI. Its post-merge workflow auto-creates an infra
+dependency PR via `devx.ci.create_dependency_pr --repo oblachno/infra
+--package grm`. The PR bumps the pinned grm version in infra's
+`pyproject.toml`.
+
+### sso-bridge → infra
+
+sso-bridge publishes to PyPI AND builds a Docker image. Its post-merge
+workflow auto-creates an infra dependency PR via
+`devx.ci.create_dependency_pr --repo oblachno/infra --package
+sso_bridge`. The PR bumps the pinned sso_bridge version.
+
+The Docker image is pulled by infra at deploy time (`sso-bridge:latest`).
+
+### mattermost-oidc → infra
+
+mattermost-oidc builds a Docker image tagged `:latest` and `:MM_VERSION`.
+infra pulls `mattermost-oidc:latest` at deploy time. There is no
+auto-dependency-PR — infra simply pulls the latest image.
+
+### infra → staging/production
+
+infra deploys to staging and production. The deployment:
+1. Provisions VMs from golden images
+2. Runs Ansible roles (including grm and sso-bridge roles)
+3. Pulls Docker images (sso-bridge, mattermost-oidc)
+4. Configures services
+
+## Correct Order for Cross-Repo Changes
+
+When a change spans multiple repos, follow this order:
+
+1. **devx first** — if the change starts in devx, merge and publish devx
+   first. Wait for the PyPI publish job to complete.
+2. **Bump devx in consumers** — in grm/sso-bridge/infra, bump the pinned
+   devx version, run `make setup`, verify tests pass, merge.
+3. **grm/sso-bridge second** — merge and publish grm/sso-bridge. Wait
+   for the PyPI publish + Docker image build to complete.
+4. **Auto-dependency-PRs** — grm/sso-bridge post-merge auto-creates infra
+   PRs to bump pinned versions. Wait for these PRs to appear.
+5. **Merge infra dependency PRs** — review and merge the auto-created
+   infra PRs.
+6. **infra last** — deploy to staging, validate, promote to production.
+
+## State Verification Before Deployment
+
+Before deploying infra, verify:
+
+1. **devx version consistent** — all repos pin the same devx version
+2. **grm published** — latest grm tag exists in PyPI
+3. **sso-bridge published** — latest sso_bridge tag exists in PyPI
+4. **sso-bridge image built** — latest sso-bridge Docker image exists
+5. **mattermost-oidc image built** — latest mattermost-oidc image exists
+6. **infra pins match published versions** — no stale pins
+7. **Nightly gate green** — `NIGHTLY_STATUS` is not `failed`
+
+## Quick Check Commands
+
+```bash
+# Check latest devx version
+curl -sS https://git.oblachno.oblachno.fyi/api/v1/repos/oblachno-oss/devx/releases/latest | python3 -c "import json,sys; print(json.load(sys.stdin).get('tag_name','?'))"
+
+# Check pinned devx version in each repo
+for repo in grm sso-bridge infra; do
+  echo -n "$repo: "; grep 'devx @' /home/emo/dev/ideas/oblachno/$repo/pyproject.toml | grep -oP 'v[\d.]+'
+done
+
+# Check latest sso-bridge image build
+curl -sS -H "Authorization: token $DEVELOPER_GITEA_API_TOKEN" \
+  "https://git.oblachno.oblachno.fyi/api/v1/repos/oblachno/sso-bridge/actions/runs?per_page=5" \
+  | python3 -c "import json,sys; [print(r['id'],r['status'],r['conclusion']) for r in json.load(sys.stdin).get('workflow_runs',[]) if r.get('event')=='push']"
+```
@@ -0,0 +1,90 @@
+# deployment-coordination
+
+How devx releases propagate to downstream repos. devx is the base
+package — all other repos pin it. A devx release must complete before
+consumers can bump.
+
+## When to Invoke
+
+Invoke this skill when:
+- Changes to devx affect downstream repos (grm, sso-bridge, infra)
+- Preparing a devx release that other repos depend on
+- Verifying downstream repos have bumped to the latest devx version
+- Coordinating a multi-repo change that starts in devx
+
+## Prerequisites
+
+- devx repo at `/home/emo/dev/ideas/oblachno/devx`
+- `.env` with `DEVELOPER_GITEA_API_TOKEN`
+- See `dependency-graph` skill for the full ecosystem map
+
+## What devx Produces
+
+devx publishes a Python package to the Gitea PyPI registry. Downstream
+repos pin it:
+```toml
+"devx @ git+https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git@vX.Y.Z"
+```
+
+## Release Flow
+
+1. PR merged to master
+2. Post-merge workflow runs `devx.ci.release` — classifies changes
+3. If user-facing changes: git-cliff bumps version, creates tag, pushes
+4. `devx.ci.publish` builds and publishes to Gitea PyPI registry
+5. Downstream repos must bump their pinned devx version
+
+## Downstream Consumers
+
+| Repo | Pin location | Auto-bump? |
+|------|-------------|------------|
+| grm | `pyproject.toml` | No — manual |
+| sso-bridge | `pyproject.toml` | No — manual |
+| infra | `pyproject.toml` | No — manual |
+
+devx does NOT auto-create dependency PRs in downstream repos. Bumping
+is manual: create a PR in each downstream repo to update the pinned
+version.
+
+## Coordinating a devx Change
+
+When a change to devx affects downstream repos:
+
+1. **Merge devx PR** — wait for post-merge publish to complete
+2. **Verify publish** — check the new tag exists:
+   ```bash
+   curl -sS -H "Authorization: token $DEVELOPER_GITEA_API_TOKEN" \
+     https://git.oblachno.oblachno.fyi/api/v1/repos/oblachno-oss/devx/releases/latest \
+     | python3 -c "import json,sys; print(json.load(sys.stdin).get('tag_name','?'))"
+   ```
+3. **Bump downstream repos** — for each repo (grm, sso-bridge, infra):
+   - Update `devx @ ...@vX.Y.Z` in `pyproject.toml`
+   - Run `make setup` to install the new version
+   - Run `make pytest-cov` to verify compatibility
+   - Create and merge a PR
+4. **Verify infra deploys** — after infra bumps, verify staging deploy
+   picks up the new devx version
+
+## State Verification
+
+Before starting a devx change, verify current state:
+```bash
+# Current devx version
+grep '__version__' /home/emo/dev/ideas/oblachno/devx/src/devx/__init__.py
+
+# What each repo pins
+for repo in grm sso-bridge infra; do
+  echo -n "$repo pins: "
+  grep 'devx @' /home/emo/dev/ideas/oblachno/$repo/pyproject.toml | grep -oP 'v[\d.]+'
+done
+```
+
+If pins are inconsistent across repos, bump them to the latest published
+version before starting new work.
+
+## Common Mistakes
+
+- Merging a devx PR and immediately merging downstream PRs without
+  waiting for the publish job to complete
+- Forgetting to bump infra (it has the most complex deploy pipeline)
+- Bumping only one downstream repo when the change affects all three
@@ -0,0 +1,142 @@
+# skill-creation
+
+How to create, validate, and maintain Devin skills. Skills must be
+clear, succinct, and actionable — no AI slop.
+
+## When to Invoke
+
+Invoke this skill when:
+- Creating a new skill
+- Amending an existing skill
+- Evaluating whether a skill is needed
+- Reviewing a PR that adds or modifies skills
+
+## Prerequisites
+
+- Skill directory: `.devin/skills/<skill-name>/SKILL.md`
+- Validator: `tests/test_skills.py` (infra) or reference to it
+- Tests: `tests/unit/test_skills_validation.py` (infra)
+
+## When to Create a Skill
+
+Create a skill when:
+- An agent struggles with a task repeatedly (branch hygiene, PR order)
+- A workflow has non-obvious ordering constraints (deployment coordination)
+- A task requires specific tool usage over raw commands (CI monitoring)
+- Multiple agents need shared context (dependency graph)
+
+Do NOT create a skill for:
+- One-off tasks (use a spec instead)
+- Tasks already covered by AGENTS.md
+- Tasks that are obvious from the Makefile or README
+- Tasks that change frequently (skills should be stable)
+
+## Skill Structure
+
+Every skill MUST have:
+
+```markdown
+# <skill-name>
+
+One-line description of what the skill does.
+
+## When to Invoke
+
+2-4 bullet points describing when to use this skill.
+
+## Prerequisites
+
+What must exist before using the skill (venv, .env, tools).
+
+## <Core Content>
+
+The actual guidance. Keep it actionable.
+
+## Verification (if applicable)
+
+How to verify the skill's guidance works.
+
+## Common Mistakes (if applicable)
+
+What agents get wrong without this skill.
+```
+
+## Quality Standards
+
+### Do
+- **Be specific.** Reference exact make targets, file paths, commands.
+- **Be concise.** Each section should be scannable in under 30 seconds.
+- **Be actionable.** Every paragraph should tell the agent what to DO.
+- **Use tables** for command reference, mappings, and comparisons.
+- **Use code blocks** for commands the agent should run.
+- **Link to other skills** when related (e.g., "See `dependency-graph` skill").
+
+### Don't
+- **No preamble.** Don't start with "This skill helps agents..." — just state what it does.
+- **No filler.** Don't repeat information from AGENTS.md or other skills.
+- **No vague advice.** "Be careful with branches" is useless. "Run `git branch --show-current` before every commit" is useful.
+- **No AI slop.** Don't write "In this comprehensive guide, we will explore..." — just give the guidance.
+- **No redundant sections.** If "Common Mistakes" would repeat "When to Invoke", skip it.
+- **No marketing.** Don't describe the skill as "powerful" or "comprehensive".
+
+## Scope Rules
+
+- **One skill per concern.** Don't mix branch hygiene with CI monitoring.
+- **Project-specific, not generic.** Skills reference this repo's make targets, file paths, and conventions — not abstract advice.
+- **Shared skills must be identical across repos.** Use `SHARED_SKILLS` in the validator to enforce this.
+- **Per-repo skills must reflect that repo's reality.** Don't copy infra-specific targets to sso-bridge.
+
+## Automated Validation
+
+Every skill must pass the validator (`tests/test_skills.py`). The validator checks:
+
+1. **Structure** — H1 title, "When to Invoke" section, "Prerequisites" section
+2. **Commands** — referenced `make <target>` commands exist in Makefile or devx.mak
+3. **Paths** — referenced file paths exist in the repo
+4. **Shared skills** — identical content across repos (SHA-256 comparison)
+5. **No drift** — no references to nonexistent commands or files
+
+Run the validator:
+```bash
+python3 tests/test_skills.py --repo infra --repo sso-bridge
+```
+
+## Effectiveness Evaluation
+
+### Static Checks (automated, CI)
+
+The validator runs in CI as part of `make pytest-cov`. A failing skill
+test blocks the PR. This catches:
+- Missing sections
+- Invalid commands
+- Broken file references
+- Cross-repo drift
+
+### Runtime Metrics (manual, periodic)
+
+Track these signals to evaluate skill effectiveness:
+- **Skill invocation frequency** — how often agents invoke the skill
+- **Success rate when invoked** — did the skill prevent the mistake it targets?
+- **Feedback issues** — agents create Gitea issues with `feedback` label when a skill is unclear or wrong
+- **Mistake recurrence** — if agents still make the mistake the skill targets, the skill needs improvement
+
+### Retrospective Review
+
+Periodically (monthly or after major incidents) review skills:
+1. List all skills and their last-modified dates
+2. Check for feedback issues tagged `skill-improvement`
+3. Verify referenced commands still exist (run validator)
+4. Remove skills that are no longer relevant
+5. Update skills where mistakes still recur
+6. Document lessons in this skill's "Common Mistakes" section
+
+## Creating a New Skill — Checklist
+
+- [ ] Identify the repeated struggle or non-obvious workflow
+- [ ] Check no existing skill covers it
+- [ ] Write the skill following the structure above
+- [ ] Run `python3 tests/test_skills.py` — must pass
+- [ ] Run `make pytest-cov` — must pass with 100% coverage
+- [ ] If shared across repos, copy identical content to each repo
+- [ ] Add the skill to `SHARED_SKILLS` in the validator if shared
+- [ ] Create PR, verify CI passes, merge
@@ -77,6 +77,9 @@ jobs:
          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
          PYTHONPATH: src
+          # Serialize blob uploads to avoid Gitea registry race condition
+          # (BlobUploader.Append offset mismatch — see DEVX-162).
+          DOCKER_MAX_CONCURRENT_UPLOADS: "1"
        run: |
          . .venv/bin/activate
          export PATH="$HOME/.local/bin:$PATH"
@@ -181,18 +181,31 @@ jobs:
      - name: Post approval review
        env:
          REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
          PR_NUMBER: ${{ github.event.number }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          . .venv/bin/activate 2>/dev/null || true
-          # Post APPROVE review via Gitea API to satisfy branch protection
-          curl -s -X POST \
-            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" \
-            -H "Authorization: token ${REVIEWER_GITEA_API_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"event":"APPROVED","body":"Auto-approved: all CI checks passed (validate job)."}' \
-            || echo "::warning::Failed to post approval review (best-effort)."
+          # Post APPROVE review via Gitea API to satisfy branch protection.
+          # Try REVIEWER_GITEA_API_TOKEN first; fall back to CI_GITEA_API_TOKEN
+          # (CI bot account) if the reviewer token is the same user as the PR
+          # creator (Gitea rejects self-approvals).
+          for TOKEN in "${REVIEWER_GITEA_API_TOKEN}" "${CI_GITEA_API_TOKEN}"; do
+            [ -z "$TOKEN" ] && continue
+            RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
+              "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d '{"event":"APPROVED","body":"Auto-approved: all CI checks passed (validate job)."}')
+            HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+            BODY=$(echo "$RESPONSE" | head -n -1)
+            if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "201" ]; then
+              echo "Approval posted successfully (HTTP $HTTP_CODE)."
+              break
+            fi
+            echo "::warning::Approval with token failed (HTTP $HTTP_CODE): ${BODY}"
+          done
      - name: Squash merge with task ID
        env:
          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
@@ -2,6 +2,52 @@

 All notable changes to this project will be documented in this file.

+## [0.51.9] - 2026-08-26
+
+### Bug Fixes
+
+- Exclude docs/plans/* from PR size check
+
+## [0.51.8] - 2026-08-26
+
+### Bug Fixes
+
+- Accept deps: as valid conventional commit type
+
+## [0.51.7] - 2026-08-26
+
+### Bug Fixes
+
+- Increase HTTP 500 retry count to 5 with longer backoff and visible logging
+
+## [0.51.6] - 2026-08-26
+
+### Bug Fixes
+
+- Use stderr=STDOUT to capture all docker push output in one stream
+
+## [0.51.5] - 2026-08-26
+
+### Bug Fixes
+
+- Check stdout for HTTP 500 in _run_push (docker sends to stdout)
+
+## [0.51.4] - 2026-08-26
+
+### Bug Fixes
+
+- Serialize registry uploads and retry on HTTP 500
+
+### Refactor
+
+- Remove cross-repo contract tests from devx
+
+## [0.51.3] - 2026-08-26
+
+### Bug Fixes
+
+- Fall back to CI bot token for auto-merge approval
+
 ## [0.51.2] - 2026-08-26

 ### Bug Fixes
@@ -16,12 +16,12 @@ quality badges.

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/python.svg)](https://www.python.org/downloads/)

 ## Why devx?

@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.51.2",
+    "devx>=0.51.9",
 ]

 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```

 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.51.2"`) or use a version constraint
-> (for example, `"devx>=0.51.2,<0.52"`).
+> `dependencies` (for example, `"devx==0.51.9"`) or use a version constraint
+> (for example, `"devx>=0.51.9,<0.52"`).

 ### Optional extras

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/eaad6892ec0248e2a8b08a7c4e165d5517ff3f92/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/09be76620c0a26418c614fb26b7feec2a4f457d3/python.svg)](https://www.python.org/downloads/)

 ## Overview

@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.51.2",
+    "devx>=0.51.9",
 ]

 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```

-Pin a specific version if needed: `"devx==0.51.2"` or `"devx>=0.51.2,<0.52"`.
+Pin a specific version if needed: `"devx==0.51.9"` or `"devx>=0.51.9,<0.52"`.

 ### Optional extras

@@ -0,0 +1,31 @@
+# DEVX-160: Remove cross-repo contract tests from devx
+
+## Problem
+devx unit tests (`test_spec_driven_workflows.py`) were validating workflow
+YAML and skill files in infra, grm, sso-bridge, and Mattermost OIDC repos.
+This is an architecture violation — devx must not be aware of other repos.
+Those repos consume devx; devx does not test them.
+
+## Approach
+Rewrite `test_spec_driven_workflows.py` to only test devx's own workflows
+and skills. Remove all references to `_OBLACHNO_ROOT`, `_INFRA`, `_GRM`,
+`_SSO_BRIDGE`, and parametrized repo lists.
+
+REQ-1: No references to other repos in devx tests
+REQ-2: All devx workflow/skill tests still pass
+REQ-3: 100% coverage maintained
+
+## Test Plan
+- Run `pytest tests/unit/test_spec_driven_workflows.py` — all pass
+- Run full test suite with coverage — 100%
+
+## Deploy Plan
+- Merge to master
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: No references to other repos in devx tests
+- [x] REQ-2: All devx workflow/skill tests still pass
+- [x] REQ-3: 100% coverage maintained
@@ -0,0 +1,27 @@
+# DEVX-161: Fix auto-merge self-approval: use CI bot token fallback
+
+## Problem
+The auto-merge workflow posts an APPROVE review using
+`REVIEWER_GITEA_API_TOKEN`. When this token belongs to the same user
+who created the PR, Gitea rejects the self-approval, causing the merge
+to fail with HTTP 405 "Does not have enough approvals."
+
+## Approach
+Try `REVIEWER_GITEA_API_TOKEN` first; if it fails (self-approval
+rejection), fall back to `CI_GITEA_API_TOKEN` (kireto — CI bot account).
+
+REQ-1: Auto-merge posts approval with fallback to CI bot token
+REQ-2: Approval step reports which token succeeded
+
+## Test Plan
+- Create a PR and observe auto-merge succeeds
+
+## Deploy Plan
+- Merge to master
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: Auto-merge posts approval with fallback to CI bot token
+- [x] REQ-2: Approval step reports which token succeeded
@@ -0,0 +1,41 @@
+# DEVX-162: Fix registry push race condition: serialize uploads + retry on HTTP 500
+
+## Problem
+The Gitea container registry (v1.27.2) has a known race condition in
+`BlobUploader.Append()` where concurrent blob uploads cause the file
+offset and DB model to get out of sync, producing HTTP 500 "offset
+mismatch between file and model" errors. This causes the build-images
+workflow to fail intermittently when pushing runner images.
+
+The `package_blob_upload` table accumulates stale entries from failed
+uploads that worsen the problem over time.
+
+## Approach
+Two fixes in devx (a third fix — scheduled cleanup — is tracked
+separately as OBL-INFRA-537):
+
+1. Set `DOCKER_MAX_CONCURRENT_UPLOADS=1` in the build-images workflow
+   to serialize blob uploads and avoid the race condition.
+
+2. Add HTTP 500 retry logic to `push_image` in `build_image.py`.
+   When a push fails with HTTP 500 (not "already exists"), retry up
+   to 3 times with exponential backoff (5s, 10s, 20s).
+
+REQ-1: Build-images workflow sets DOCKER_MAX_CONCURRENT_UPLOADS=1
+REQ-2: push_image retries on HTTP 500 with exponential backoff
+REQ-3: All existing tests pass with 100% coverage
+
+## Test Plan
+- Unit tests for retry logic (mock subprocess)
+- Manual: trigger build-images workflow and verify push succeeds
+
+## Deploy Plan
+- Merge to master
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: Build-images workflow sets DOCKER_MAX_CONCURRENT_UPLOADS=1
+- [x] REQ-2: push_image retries on HTTP 500 with exponential backoff
+- [x] REQ-3: All existing tests pass with 100% coverage
@@ -0,0 +1,33 @@
+# DEVX-163: Fix _run_push to check stdout for HTTP 500
+
+## Problem
+`_run_push` only checked `result.stderr` for HTTP 500, but docker push
+sends the "received unexpected HTTP status: 500 Internal Server Error"
+message to **stdout**, not stderr. This means the tenacity retry logic
+added in DEVX-162 never triggered — the push failed immediately without
+retrying.
+
+## Approach
+Check both `result.stdout` and `result.stderr` for the "500" status code.
+Also update the "already exists" check in `push_image` to check both
+streams, since docker may send that message to stdout as well.
+
+REQ-1: _run_push checks both stdout and stderr for HTTP 500
+REQ-2: push_image "already exists" check uses combined stdout+stderr
+REQ-3: All existing tests pass with 100% coverage
+
+## Test Plan
+- Unit tests for stdout 500 detection
+- Unit tests for stderr 500 detection
+- Manual: trigger build-images workflow and verify retry works
+
+## Deploy Plan
+- Merge to master
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: _run_push checks both stdout and stderr for HTTP 500
+- [x] REQ-2: push_image "already exists" check uses combined stdout+stderr
+- [x] REQ-3: All existing tests pass with 100% coverage
@@ -0,0 +1,34 @@
+# DEVX-164: Increase HTTP 500 retry count and backoff for docker push
+
+## Problem
+The HTTP 500 retry logic (DEVX-162, DEVX-163) works correctly — 3 retry
+attempts are made. But all 3 attempts fail because the Gitea registry's
+"offset mismatch" race condition needs more than ~15s to recover. The
+current backoff is 5s-20s with 3 attempts (total ~15s of waiting).
+
+## Approach
+Increase retry count from 3 to 5 and backoff from 5-20s to 10-60s,
+giving the registry up to ~2 minutes to recover. Add visible logging
+between retry attempts so the CI logs show the retry happening.
+
+REQ-1: Increase retry count from 3 to 5
+REQ-2: Increase backoff from 5-20s to 10-60s exponential
+REQ-3: Add visible logging between retry attempts (click.echo)
+REQ-4: All tests pass with 100% coverage
+
+## Test Plan
+- Unit tests verify retry count and backoff parameters
+- Unit tests verify logging output on retry
+- Manual: trigger build-images workflow and verify retries visible in logs
+
+## Deploy Plan
+- Merge to master
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: Increase retry count from 3 to 5
+- [x] REQ-2: Increase backoff from 5-20s to 10-60s exponential
+- [x] REQ-3: Add visible logging between retry attempts (click.echo)
+- [x] REQ-4: All tests pass with 100% coverage
@@ -0,0 +1,31 @@
+# DEVX-165: Accept deps: as valid conventional commit type
+
+## Problem
+The commit validator rejects `deps:` as a conventional commit type, causing
+post-merge CI failures on grm and sso-bridge repos where automated dependency
+bump PRs use `deps: bump devx...` as the commit message.
+
+## Approach
+REQ-1: Add `deps` to `CONVENTIONAL_RE` in `src/devx/config.py`
+REQ-2: Update the allowed types list in the error message in
+  `src/devx/ci/validate_commit_msg.py`
+REQ-3: Add test coverage for `deps:` type in `tests/unit/test_config.py`
+  and `tests/unit/test_validate_commit_msg.py`
+
+## Test Plan
+- `make pytest-cov` passes with 100% coverage
+- `make lint-all` passes
+
+## Deploy Plan
+- Merge to master → post-merge auto-publishes new devx version
+- grm and sso-bridge bump devx version to pick up the fix
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: Add `deps` to `CONVENTIONAL_RE` in `src/devx/config.py`
+- [x] REQ-2: Update the allowed types list in the error message in
+  `src/devx/ci/validate_commit_msg.py`
+- [x] REQ-3: Add test coverage for `deps:` type in `tests/unit/test_config.py`
+  and `tests/unit/test_validate_commit_msg.py`
@@ -0,0 +1,27 @@
+# DEVX-166: Exclude docs/plans/* from PR size check
+
+## Problem
+Planning docs in `docs/plans/` are legitimately large (700+ lines) but
+fail the PR size check (max 500 lines). This blocks PRs that only add
+planning documents.
+
+## Approach
+REQ-1: Add `docs/plans/*` to `DEFAULT_EXCLUDED_PATTERNS` in
+  `src/devx/ci/check_pr_size.py`
+REQ-2: Add test coverage for the new exclusion pattern
+
+## Test Plan
+- `make pytest-cov` passes with 100% coverage
+- `make lint-all` passes
+
+## Deploy Plan
+- Merge to master → post-merge auto-publishes new devx version
+- Infra PR #1179 picks up the fix once devx is bumped
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: Add `docs/plans/*` to `DEFAULT_EXCLUDED_PATTERNS` in
+  `src/devx/ci/check_pr_size.py`
+- [x] REQ-2: Add test coverage for the new exclusion pattern
@@ -0,0 +1,64 @@
+# DEVX-167: Add dependency-graph, deployment-coordination, and skill-creation skills
+
+## Problem
+Agents working across the oblachno ecosystem lack shared, persistent
+context for three recurring pain points:
+
+1. **Cross-repo dependency ordering** — agents frequently merge
+   downstream PRs before the upstream publish job completes, or forget
+   to bump infra. There is no single reference for which repo produces
+   what and in what order changes must propagate.
+2. **devx release coordination** — devx is the base package pinned by
+   grm, sso-bridge, and infra. Agents repeatedly merge devx PRs and
+   immediately merge downstream bumps without waiting for the PyPI
+   publish job, or bump only one consumer when a change affects all
+   three.
+3. **Skill quality drift** — skills are created ad hoc with inconsistent
+   structure, vague advice, and no automated validation reference. New
+   skills miss required sections, reference nonexistent make targets,
+   and drift across repos.
+
+## Approach
+Add three SKILL.md files under `.devin/skills/`:
+
+REQ-1: `dependency-graph` — shared skill mapping the oblachno ecosystem
+(repos, what each produces, consumers, release triggers, correct
+cross-repo change order, state verification checklist)
+
+REQ-2: `deployment-coordination` — devx-specific skill covering the
+devx release flow, downstream consumers, manual bump procedure, and
+common mistakes when coordinating a devx change
+
+REQ-3: `skill-creation` — shared skill defining skill structure,
+quality standards, scope rules, automated validation reference, and a
+creation checklist
+
+## Files Affected
+- `.devin/skills/dependency-graph/SKILL.md` (new)
+- `.devin/skills/deployment-coordination/SKILL.md` (new)
+- `.devin/skills/skill-creation/SKILL.md` (new)
+- `docs/specs/DEVX-167.md` (new)
+
+## Test Plan
+- Verify all three SKILL.md files follow the required structure (H1
+  title, When to Invoke, Prerequisites sections)
+- Verify referenced make targets and file paths exist
+- Run `make pytest-cov` — skill validation tests must pass
+
+## Deploy Plan
+- Merge to master; skills are consumed by agents immediately on next
+  invocation — no build or deploy step required
+
+## Rollback Plan
+- Revert the merge commit; remove the three skill directories
+
+## Acceptance Criteria
+- [x] REQ-1: dependency-graph skill exists with ecosystem map, repo
+      table, dependency chain, cross-repo change order, and state
+      verification checklist
+- [x] REQ-2: deployment-coordination skill exists with devx release
+      flow, downstream consumer table, coordination steps, and common
+      mistakes
+- [x] REQ-3: skill-creation skill exists with structure template,
+      quality standards, scope rules, validation reference, and
+      creation checklist
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.51.2",
+    "devx>=0.51.9",
 ]

 [project.optional-dependencies]
 dev = [
-    "devx>=0.51.2",
+    "devx>=0.51.9",
 ]
 ```

@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
 molecule testing helpers for Ansible projects.
 """

-__version__ = "0.51.2"
+__version__ = "0.51.9"
@@ -36,6 +36,7 @@ DEFAULT_EXCLUDED_PATTERNS = [
    "CHANGELOG.md",
    "README.md",
    "docs/index.md",
+    "docs/plans/*",
    "*.svg",
    "uv.lock",
    "poetry.lock",
@@ -118,7 +118,7 @@ def main(commit_msg_file: str | None, branch: str | None, from_git: bool) -> Non
                "  Expected: <type>: <description>\n"
                "  Got:      {subject}\n"
                "  Allowed types: feat, fix, chore, docs, style, refactor,\n"
-                "                 perf, test, ci, build, revert, BREAKING CHANGE",
+                "                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
                subject=subject,
            )
        )
@@ -93,4 +93,4 @@ RETRY_BACKOFF_BASE = 2  # seconds: 2, 4, 8
 RETRY_STATUS_CODES = {429, 500, 502, 503, 504}

 # Conventional commit regex — used by validate_commit_msg.py
-CONVENTIONAL_RE = re.compile(r"^(feat|fix|chore|docs|style|refactor|perf|test|ci|build|revert)(\(.+\))?: .+")
+CONVENTIONAL_RE = re.compile(r"^(feat|fix|chore|docs|style|refactor|perf|test|ci|build|revert|deps)(\(.+\))?: .+")
@@ -50,6 +50,7 @@ from dataclasses import dataclass, field
 from pathlib import Path

 import click
+from tenacity import retry, retry_if_exception_type, stop_after_attempt, wait_exponential

 from devx.i18n import _
 from devx.tokens import get_developer_token
@@ -254,6 +255,36 @@ def delete_remote_manifest(
    return True


+class PushHTTP500Error(Exception):
+    """Raised when docker push fails with an HTTP 500 from the registry."""
+
+
+def _run_push(cmd: list[str]) -> subprocess.CompletedProcess[str]:
+    """Run a docker push command, raising PushHTTP500Error on registry 500.
+
+    The Gitea container registry (v1.27.x) has a race condition in
+    BlobUploader.Append that causes intermittent HTTP 500 "offset
+    mismatch" errors during concurrent blob uploads.  Retrying the
+    push gives the registry time to recover.
+
+    Docker sends push progress/errors to both stdout and stderr depending
+    on the error type, so both streams are checked for the 500 status.
+    Uses stderr=STDOUT to merge both streams into stdout, ensuring all
+    output is captured in one place (docker push output behavior varies
+    depending on TTY detection).
+    """
+    result = subprocess.run(  # nosec B603
+        cmd,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0 and "500" in (result.stdout or ""):
+        raise PushHTTP500Error(result.stdout.strip())
+    return result
+
+
 def push_image(
    spec: ImageSpec,
    registry: str,
@@ -270,6 +301,9 @@ def push_image(
    with Gitea #31964 ("package version already exists") do we delete
    the old manifest and retry.  This avoids losing the existing tag
    when the push fails for unrelated reasons (e.g. HTTP 500).
+
+    HTTP 500 errors from the Gitea registry race condition are retried
+    up to 3 times with exponential backoff (5s, 10s) via tenacity.
    """
    full_tags = [build_full_tag(registry, spec.name, t) for t in spec.tags]
    all_ok = True
@@ -279,19 +313,41 @@ def push_image(
            click.echo(f"[dry-run] {' '.join(cmd)}")
            continue
        click.echo(f"Pushing {ft}...")
-        result = subprocess.run(  # nosec B603
-            cmd,
-            capture_output=True,
-            text=True,
-            check=False,
+
+        @retry(
+            stop=stop_after_attempt(5),
+            wait=wait_exponential(multiplier=10, min=10, max=60),
+            retry=retry_if_exception_type(PushHTTP500Error),
+            before_sleep=lambda retry_state: click.echo(
+                _(
+                    "  HTTP 500 from registry, retrying in {wait:.0f}s (attempt {attempt}/5)...",
+                    wait=retry_state.next_action.sleep if retry_state.next_action else 0,
+                    attempt=retry_state.attempt_number + 1,
+                ),
+                err=True,
+            ),
+            reraise=True,
        )
+        def _attempt(_cmd: list[str] = cmd) -> subprocess.CompletedProcess[str]:
+            return _run_push(_cmd)
+
+        try:
+            result = _attempt()
+        except PushHTTP500Error as e:
+            click.echo(
+                _("Push failed for {tag}: {error}", tag=ft, error=str(e)),
+                err=True,
+            )
+            all_ok = False
+            continue
+
        if result.returncode == 0:
            click.echo(f"Pushed {ft}")
            continue
-        stderr = result.stderr.strip()
+        combined_output = (result.stdout or "").strip()
        # Gitea #31964: push fails because tag already exists.
        # Delete the old manifest and retry once.
-        if username and token and "already exists" in stderr.lower():
+        if username and token and "already exists" in combined_output.lower():
            click.echo("  Tag exists (Gitea #31964), deleting old manifest and retrying...")
            delete_remote_manifest(
                registry,
@@ -304,16 +360,17 @@ def push_image(
            click.echo(f"  Retrying push {ft}...")
            result = subprocess.run(  # nosec B603
                cmd,
-                capture_output=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.STDOUT,
                text=True,
                check=False,
            )
            if result.returncode == 0:
                click.echo(f"Pushed {ft} (after retry)")
                continue
-            stderr = result.stderr.strip()
+            combined_output = (result.stdout or "").strip()
        click.echo(
-            _("Push failed for {tag}: {error}", tag=ft, error=stderr),
+            _("Push failed for {tag}: {error}", tag=ft, error=combined_output),
            err=True,
        )
        all_ok = False
@@ -2999,13 +2999,13 @@
    "PR number for label check": "PR number for label check",
    "Repo (owner/name) for label check": "Repo (owner/name) for label check"
  },
-  "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE": {
-    "bg": "Опа! Съобщението за commit трябва да следва конвенционален формат.\n  Очаква се: <type>: <description>\n  Получено: {subject}\n  Разрешени типове: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "de": "Ups! Commit-Nachricht muss dem konventionellen Commit-Format folgen.\n  Erwartet: <type>: <description>\n  Erhalten: {subject}\n  Erlaubte Typen: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "en": "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "pl": "Ups! Wiadomość commit musi być w formacie conventional commit.\n  Oczekiwano: <typ>: <opis>\n  Otrzymano:  {subject}\n  Dozwolone typy: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "ru": "Ой! Сообщение коммита должно соответствовать формату conventional commit.\n  Ожидается: <type>: <description>\n  Получено: {subject}\n  Допустимые типы: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
-    "zh": "哎呀！提交消息必须遵循 conventional commit 格式。\n  预期格式: <type>: <description>\n  实际: {subject}\n  允许的类型: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
+  "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE": {
+    "bg": "Опа! Съобщението за commit трябва да следва конвенционален формат.\n  Очаква се: <type>: <description>\n  Получено: {subject}\n  Разрешени типове: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
+    "de": "Ups! Commit-Nachricht muss dem konventionellen Commit-Format folgen.\n  Erwartet: <type>: <description>\n  Erhalten: {subject}\n  Erlaubte Typen: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
+    "en": "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
+    "pl": "Ups! Wiadomość commit musi być w formacie conventional commit.\n  Oczekiwano: <typ>: <opis>\n  Otrzymano:  {subject}\n  Dozwolone typy: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
+    "ru": "Ой! Сообщение коммита должно соответствовать формату conventional commit.\n  Ожидается: <type>: <description>\n  Получено: {subject}\n  Допустимые типы: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
+    "zh": "哎呀！提交消息必须遵循 conventional commit 格式。\n  预期格式: <type>: <description>\n  实际: {subject}\n  允许的类型: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, deps, revert, BREAKING CHANGE",
    "PR number for label check": "PR number for label check",
    "Repo (owner/name) for label check": "Repo (owner/name) for label check"
  },
@@ -5152,5 +5152,13 @@
    "pl": "PR has 'refactoring' label — size check bypassed.",
    "ru": "PR has 'refactoring' label — size check bypassed.",
    "zh": "PR has 'refactoring' label — size check bypassed."
+  },
+  "  HTTP 500 from registry, retrying in {wait:.0f}s (attempt {attempt}/5)...": {
+    "en": "HTTP 500 from registry, retrying in {wait:.0f}s (attempt {attempt}/5)...",
+    "bg": "  HTTP 500 от регистъра, повторен опит след {wait:.0f}с (опит {attempt}/5)...",
+    "de": "  HTTP 500 vom Registry, Wiederholung in {wait:.0f}s (Versuch {attempt}/5)...",
+    "pl": "  HTTP 500 z rejestru, ponawianie za {wait:.0f}s (próba {attempt}/5)...",
+    "ru": "  HTTP 500 от реестра, повтор через {wait:.0f}с (попытка {attempt}/5)...",
+    "zh": "  注册表返回 HTTP 500，{wait:.0f}秒后重试（第{attempt}/5次尝试）..."
  }
 }
@@ -13,6 +13,7 @@ from click.testing import CliRunner
 import devx.tools.build_image as build_image
 from devx.tools.build_image import (
    ImageSpec,
+    PushHTTP500Error,
    build_full_tag,
    delete_remote_manifest,
    load_manifest,
@@ -197,7 +198,7 @@ class TestBuildImage:
 class TestPushImage:
    def test_success(self) -> None:
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest", "1.0"])
-        mock_result = MagicMock(returncode=0, stderr="", stdout="")
+        mock_result = MagicMock(returncode=0, stdout="")
        with patch("devx.tools.build_image.subprocess.run", return_value=mock_result) as mock_run:
            assert push_image(spec, "git.example.com") is True
            assert mock_run.call_count == 2
@@ -205,8 +206,8 @@ class TestPushImage:
    def test_partial_failure(self) -> None:
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest", "1.0"])
        results = [
-            MagicMock(returncode=0, stderr="", stdout=""),
-            MagicMock(returncode=1, stderr="push failed", stdout=""),
+            MagicMock(returncode=0, stdout=""),
+            MagicMock(returncode=1, stdout="push failed"),
        ]
        with patch("devx.tools.build_image.subprocess.run", side_effect=results):
            assert push_image(spec, "git.example.com") is False
@@ -220,7 +221,7 @@ class TestPushImage:
    def test_no_delete_on_success_with_creds(self) -> None:
        """Push-first: no delete needed when push succeeds."""
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
-        mock_result = MagicMock(returncode=0, stderr="", stdout="")
+        mock_result = MagicMock(returncode=0, stdout="")
        with (
            patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
@@ -230,7 +231,7 @@ class TestPushImage:

    def test_no_delete_without_creds(self) -> None:
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
-        mock_result = MagicMock(returncode=0, stderr="", stdout="")
+        mock_result = MagicMock(returncode=0, stdout="")
        with (
            patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
@@ -242,8 +243,8 @@ class TestPushImage:
        """Gitea #31964: push fails with 'already exists', delete + retry."""
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
        results = [
-            MagicMock(returncode=1, stderr="500 Internal Server Error: already exists", stdout=""),
-            MagicMock(returncode=0, stderr="", stdout=""),
+            MagicMock(returncode=1, stdout="package version already exists"),
+            MagicMock(returncode=0, stdout=""),
        ]
        with (
            patch("devx.tools.build_image.subprocess.run", side_effect=results),
@@ -260,11 +261,9 @@ class TestPushImage:
            )

    def test_no_delete_on_non_already_exists_failure(self) -> None:
-        """Push fails for other reasons (HTTP 500) — old manifest preserved."""
+        """Push fails for other reasons (non-500) — old manifest preserved."""
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
-        mock_result = MagicMock(
-            returncode=1, stderr="received unexpected HTTP status: 500 Internal Server Error", stdout=""
-        )
+        mock_result = MagicMock(returncode=1, stdout="denied: requested access to the resource is denied")
        with (
            patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
@@ -276,8 +275,8 @@ class TestPushImage:
        """Gitea #31964 retry also fails — both pushes fail."""
        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
        results = [
-            MagicMock(returncode=1, stderr="500 Internal Server Error: already exists", stdout=""),
-            MagicMock(returncode=1, stderr="push failed again", stdout=""),
+            MagicMock(returncode=1, stdout="package version already exists"),
+            MagicMock(returncode=1, stdout="push failed again"),
        ]
        with (
            patch("devx.tools.build_image.subprocess.run", side_effect=results),
@@ -285,6 +284,60 @@ class TestPushImage:
        ):
            assert push_image(spec, "git.example.com", username="user", token="tok") is False

+    def test_http_500_retries_then_succeeds(self) -> None:
+        """HTTP 500 from registry race condition — retry succeeds."""
+        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
+        results = [
+            MagicMock(returncode=1, stdout="received unexpected HTTP status: 500 Internal Server Error"),
+            MagicMock(returncode=0, stdout=""),
+        ]
+        with (
+            patch("devx.tools.build_image.subprocess.run", side_effect=results),
+            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
+            patch("time.sleep"),
+        ):
+            assert push_image(spec, "git.example.com", username="user", token="tok") is True
+            mock_del.assert_not_called()
+
+    def test_http_500_retries_all_fail(self) -> None:
+        """HTTP 500 retries exhausted — push fails, no delete attempted."""
+        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
+        mock_result = MagicMock(returncode=1, stdout="received unexpected HTTP status: 500 Internal Server Error")
+        with (
+            patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
+            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
+            patch("time.sleep"),
+        ):
+            assert push_image(spec, "git.example.com", username="user", token="tok") is False
+            mock_del.assert_not_called()
+
+    def test_run_push_raises_on_500(self) -> None:
+        """_run_push raises PushHTTP500Error when stdout contains 500."""
+        from devx.tools.build_image import _run_push
+
+        mock_result = MagicMock(returncode=1, stdout="received unexpected HTTP status: 500 Internal Server Error")
+        with patch("devx.tools.build_image.subprocess.run", return_value=mock_result):
+            with pytest.raises(PushHTTP500Error, match="500"):
+                _run_push(["docker", "push", "img:latest"])
+
+    def test_run_push_no_raise_on_non_500(self) -> None:
+        """_run_push returns result when stdout has no 500."""
+        from devx.tools.build_image import _run_push
+
+        mock_result = MagicMock(returncode=1, stdout="denied: access denied")
+        with patch("devx.tools.build_image.subprocess.run", return_value=mock_result):
+            result = _run_push(["docker", "push", "img:latest"])
+            assert result.returncode == 1
+
+    def test_run_push_no_raise_on_success(self) -> None:
+        """_run_push returns result on success."""
+        from devx.tools.build_image import _run_push
+
+        mock_result = MagicMock(returncode=0, stdout="")
+        with patch("devx.tools.build_image.subprocess.run", return_value=mock_result):
+            result = _run_push(["docker", "push", "img:latest"])
+            assert result.returncode == 0
+

 class TestDeleteRemoteManifest:
    def test_dry_run(self) -> None:
@@ -26,6 +26,12 @@ class TestIsExcluded:
    def test_excludes_readme(self) -> None:
        assert is_excluded("README.md", ["README.md"])

+    def test_excludes_plans_glob(self) -> None:
+        assert is_excluded("docs/plans/sso-bridge-full-extraction.md", ["docs/plans/*"])
+
+    def test_does_not_exclude_specs(self) -> None:
+        assert not is_excluded("docs/specs/DEVX-165.md", ["docs/plans/*"])
+

 class TestCheckSize:
    def test_under_limits_passes(self) -> None:
@@ -38,6 +38,7 @@ class TestConfigConstants:
    def test_conventional_re(self) -> None:
        assert CONVENTIONAL_RE.match("feat: add feature")
        assert CONVENTIONAL_RE.match("fix(scope): bug fix")
+        assert CONVENTIONAL_RE.match("deps: bump devx from v0.50.2 to v0.51.0")
        assert not CONVENTIONAL_RE.match("random message")
        assert not CONVENTIONAL_RE.match("feat:")
        assert not CONVENTIONAL_RE.match("BREAKING CHANGE: something")
@@ -1,13 +1,12 @@
-"""Structural tests for spec-driven development workflows and skills.
+"""Structural tests for spec-driven development workflows and skills in devx.

-These tests parse the actual workflow YAML files in each repo and assert
-that the new spec-driven development steps, jobs, and env vars are present
-and correctly wired. They also validate that the spec-driven-development
-skill exists in each repo's .devin/skills/ directory with required sections.
+These tests parse devx's own workflow YAML files and assert that the
+spec-driven development steps, jobs, and env vars are present and
+correctly wired. They also validate that the skills exist in devx's
+own .devin/skills/ directory with required sections.

-This is a "contract test" — it verifies that the workflows we wrote match
-the intended structure, catching regressions if someone edits a workflow
-and accidentally removes a step or breaks a job dependency.
+devx must NOT be aware of other repos (infra, grm, sso-bridge). Those
+repos consume devx; devx does not test them.
 """

 from __future__ import annotations
@@ -17,38 +16,26 @@ from pathlib import Path
 import pytest
 import yaml

-# Repo root paths
+# devx repo root
 # __file__ = .../devx/tests/unit/test_spec_driven_workflows.py
-# parents[3] = .../oblachno (the monorepo root containing all repos)
-_OBLACHNO_ROOT = Path(__file__).resolve().parents[3]
-_INFRA = _OBLACHNO_ROOT / "infra"
-_GRM = _OBLACHNO_ROOT / "grm"
-_SSO_BRIDGE = _OBLACHNO_ROOT / "sso-bridge"
-_DEVX = _OBLACHNO_ROOT / "devx"
+# parents[2] = .../devx
+_DEVX = Path(__file__).resolve().parents[2]


-def _load_workflow(repo_path: Path, filename: str) -> dict:
-    """Load a workflow YAML file and return parsed dict."""
-    path = repo_path / ".gitea" / "workflows" / filename
+def _load_workflow(filename: str) -> dict:
+    """Load a devx workflow YAML file and return parsed dict."""
+    path = _DEVX / ".gitea" / "workflows" / filename
    if not path.exists():
-        pytest.skip(f"Workflow {filename} not found in {repo_path.name}")
+        pytest.skip(f"Workflow {filename} not found in devx")
    with open(path, encoding="utf-8") as f:
        return yaml.safe_load(f)


-def _skip_if_repo_missing(repo_name: str) -> None:
-    """Skip test if the sibling repo directory doesn't exist (CI only checks out one repo)."""
-    repo_path = _OBLACHNO_ROOT / repo_name
-    if not repo_path.is_dir():
-        pytest.skip(f"Repo {repo_name} not found at {repo_path} (CI only checks out devx)")
-
-
-def _read_skill(repo_name: str, skill_name: str) -> str:
-    """Read a skill file from a repo, skipping if the repo or file doesn't exist."""
-    _skip_if_repo_missing(repo_name)
-    skill_path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / skill_name / "SKILL.md"
+def _read_skill(skill_name: str) -> str:
+    """Read a skill file from devx's .devin/skills/ directory."""
+    skill_path = _DEVX / ".devin" / "skills" / skill_name / "SKILL.md"
    if not skill_path.exists():
-        pytest.skip(f"SKILL.md not found in {repo_name}/{skill_name}")
+        pytest.fail(f"SKILL.md not found for {skill_name} in devx")
    return skill_path.read_text(encoding="utf-8")


@@ -75,14 +62,14 @@ def _get_run_commands(step: dict) -> str:


 # ============================================================================
-# Infra ci.yml — spec validation + PR size + fast molecule
+# devx ci.yml — spec validation + PR size
 # ============================================================================


-class TestInfraCiWorkflow:
+class TestDevxCiWorkflow:
    @pytest.fixture
    def workflow(self) -> dict:
-        return _load_workflow(_INFRA, "ci.yml")
+        return _load_workflow("ci.yml")

    def test_validate_job_exists(self, workflow: dict) -> None:
        assert "validate" in workflow["jobs"]
@@ -113,321 +100,36 @@ class TestInfraCiWorkflow:
        step = _find_step(workflow["jobs"]["validate"], "Validate spec file")
        assert step is not None
        env = step.get("env", {})
-        assert env.get("DEVX_TASK_PREFIX") == "OBL-INFRA"
+        assert env.get("DEVX_TASK_PREFIX") == "DEVX"

-    def test_has_fast_molecule_job(self, workflow: dict) -> None:
-        assert "fast-molecule" in workflow["jobs"], "ci.yml must have 'fast-molecule' job (replaced molecule-tests)"
-
-    def test_no_full_molecule_tests_job(self, workflow: dict) -> None:
-        assert "molecule-tests" not in workflow["jobs"], "ci.yml must NOT have 'molecule-tests' job (moved to nightly)"
-
-    def test_no_staging_deploy_in_ci(self, workflow: dict) -> None:
-        # The staging deploy was moved to post-merge (auto-deploy-staging)
-        job_names = list(workflow["jobs"].keys())
-        assert "staging-health-gate" not in job_names, "staging-health-gate removed from ci.yml (moved to nightly)"
-        assert "pre-deploy-checks" not in job_names, "pre-deploy-checks removed from ci.yml (moved to nightly)"
-        assert "deploy" not in job_names, "deploy job removed from ci.yml (moved to post-merge)"
-
-    def test_fast_molecule_uses_devx_module(self, workflow: dict) -> None:
-        job = workflow["jobs"]["fast-molecule"]
-        step = _find_step(job, "Detect changed roles")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        assert "devx.ci.fast_molecule" in cmd
-        assert "--github-output" in cmd
-
-    def test_fast_molecule_timeout_is_short(self, workflow: dict) -> None:
-        job = workflow["jobs"]["fast-molecule"]
-        assert job.get("timeout-minutes", 999) <= 30, (
-            "fast-molecule timeout should be <= 30 min (was 120 for full suite)"
-        )
-
-    def test_fast_molecule_no_matrix(self, workflow: dict) -> None:
-        job = workflow["jobs"]["fast-molecule"]
-        assert "strategy" not in job or "matrix" not in job.get("strategy", {}), (
-            "fast-molecule should not use matrix (single runner)"
-        )
-
-    def test_auto_merge_depends_on_fast_molecule(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("auto-merge", {})
-        needs = job.get("needs", [])
-        assert "fast-molecule" in needs, "auto-merge must depend on fast-molecule (not deploy)"
-
-    def test_auto_merge_does_not_depend_on_deploy(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("auto-merge", {})
-        needs = job.get("needs", [])
-        assert "deploy" not in needs, "auto-merge must NOT depend on deploy (removed from PR pipeline)"
+    def test_has_auto_merge_job(self, workflow: dict) -> None:
+        assert "auto-merge" in workflow["jobs"], "ci.yml must have 'auto-merge' job"


 # ============================================================================
-# Infra nightly.yml — full molecule + staging deploy + gate
+# devx post-merge.yml — release + publish
 # ============================================================================


-class TestInfraNightlyWorkflow:
+class TestDevxPostMergeWorkflow:
    @pytest.fixture
    def workflow(self) -> dict:
-        return _load_workflow(_INFRA, "nightly.yml")
-
-    def test_nightly_workflow_exists(self, workflow: dict) -> None:
-        assert workflow is not None
-
-    def test_has_full_molecule_job(self, workflow: dict) -> None:
-        assert "full-molecule" in workflow["jobs"]
-
-    def test_has_set_gate_status_job(self, workflow: dict) -> None:
-        assert "set-gate-status" in workflow["jobs"]
-
-    def test_has_staging_deploy_job(self, workflow: dict) -> None:
-        assert "staging-deploy" in workflow["jobs"]
-
-    def test_full_molecule_uses_matrix(self, workflow: dict) -> None:
-        job = workflow["jobs"]["full-molecule"]
-        strategy = job.get("strategy", {})
-        assert "matrix" in strategy, "full-molecule must use matrix (6 runners)"
-        assert "runner-index" in strategy["matrix"]
-
-    def test_full_molecule_timeout_is_long(self, workflow: dict) -> None:
-        job = workflow["jobs"]["full-molecule"]
-        assert job.get("timeout-minutes", 0) >= 90, "full-molecule timeout should be >= 90 min (full suite)"
-
-    def test_set_gate_status_depends_on_full_molecule(self, workflow: dict) -> None:
-        job = workflow["jobs"]["set-gate-status"]
-        needs = job.get("needs", [])
-        assert "full-molecule" in needs
-
-    def test_set_gate_status_uses_nightly_gate_module(self, workflow: dict) -> None:
-        job = workflow["jobs"]["set-gate-status"]
-        step = _find_step(job, "Set nightly gate")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        assert "devx.ci.nightly_gate" in cmd
-        assert "set-passed" in cmd or "set-failed" in cmd
-
-    def test_staging_deploy_depends_on_gate(self, workflow: dict) -> None:
-        job = workflow["jobs"]["staging-deploy"]
-        needs = job.get("needs", [])
-        assert "set-gate-status" in needs
-        assert "full-molecule" in needs
-
-    def test_staging_deploy_only_on_success(self, workflow: dict) -> None:
-        job = workflow["jobs"]["staging-deploy"]
-        if_cond = job.get("if", "")
-        assert "success" in if_cond, "staging-deploy must only run when full-molecule succeeds"
-
-    def test_nightly_runs_on_schedule(self, workflow: dict) -> None:
-        on = workflow.get("on", workflow.get(True, {}))
-        # YAML may parse 'on' as True (boolean)
-        if isinstance(on, dict):
-            assert "schedule" in on, "nightly must have schedule trigger"
-        else:
-            pytest.fail("Could not parse 'on' trigger from nightly.yml")
-
-
-# ============================================================================
-# Infra post-merge.yml — auto-deploy staging with nightly gate
-# ============================================================================
-
-
-class TestInfraPostMergeWorkflow:
-    @pytest.fixture
-    def workflow(self) -> dict:
-        return _load_workflow(_INFRA, "post-merge.yml")
-
-    def test_has_auto_deploy_staging_job(self, workflow: dict) -> None:
-        assert "auto-deploy-staging" in workflow["jobs"], "post-merge must have 'auto-deploy-staging' job"
-
-    def test_has_staging_deploy_job(self, workflow: dict) -> None:
-        assert "staging-deploy" in workflow["jobs"], "post-merge must have 'staging-deploy' reusable workflow job"
-
-    def test_auto_deploy_staging_checks_nightly_gate(self, workflow: dict) -> None:
-        job = workflow["jobs"]["auto-deploy-staging"]
-        step = _find_step(job, "Check nightly gate")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        assert "devx.ci.nightly_gate" in cmd
-        assert "--action check" in cmd
-
-    def test_staging_deploy_depends_on_auto_deploy_staging(self, workflow: dict) -> None:
-        job = workflow["jobs"]["staging-deploy"]
-        needs = job.get("needs", [])
-        assert "auto-deploy-staging" in needs
-
-    def test_staging_deploy_gated_on_gate_passed(self, workflow: dict) -> None:
-        job = workflow["jobs"]["staging-deploy"]
-        if_cond = job.get("if", "")
-        assert "gate-passed" in if_cond, "staging-deploy must check gate-passed output"
-
-    def test_auto_deploy_production_waits_for_staging(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("auto-deploy-production", {})
-        needs = job.get("needs", [])
-        assert "staging-deploy" in needs, "auto-deploy-production must wait for staging-deploy"
-
-
-# ============================================================================
-# GRM ci.yml — spec validation + PR size
-# ============================================================================
-
-
-class TestGrmCiWorkflow:
-    @pytest.fixture
-    def workflow(self) -> dict:
-        return _load_workflow(_GRM, "ci.yml")
-
-    def test_has_spec_validation_step(self, workflow: dict) -> None:
-        steps = _get_step_names(workflow["jobs"]["validate"])
-        assert any("Validate spec file" in s for s in steps)
-
-    def test_has_pr_size_check_step(self, workflow: dict) -> None:
-        steps = _get_step_names(workflow["jobs"]["validate"])
-        assert any("Check PR size" in s for s in steps)
-
-    def test_spec_validation_sets_task_prefix(self, workflow: dict) -> None:
-        step = _find_step(workflow["jobs"]["validate"], "Validate spec file")
-        assert step is not None
-        env = step.get("env", {})
-        assert env.get("DEVX_TASK_PREFIX") == "GRM"
-
-
-# ============================================================================
-# GRM post-merge.yml — auto-create infra dependency PR
-# ============================================================================
-
-
-class TestGrmPostMergeWorkflow:
-    @pytest.fixture
-    def workflow(self) -> dict:
-        return _load_workflow(_GRM, "post-merge.yml")
-
-    def test_has_create_dependency_pr_step(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("release-and-maintain", {})
-        step = _find_step(job, "Create infra dependency PR")
-        assert step is not None, "grm post-merge must have 'Create infra dependency PR' step"
-
-    def test_dependency_pr_uses_correct_module(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("release-and-maintain", {})
-        step = _find_step(job, "Create infra dependency PR")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        assert "devx.ci.create_dependency_pr" in cmd
-        assert "--package grm" in cmd
-        assert "--repo oblachno/infra" in cmd
-
-    def test_dependency_pr_is_best_effort(self, workflow: dict) -> None:
-        import re
-
-        job = workflow["jobs"].get("release-and-maintain", {})
-        step = _find_step(job, "Create infra dependency PR")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        # Must not fail the workflow if PR creation fails.
-        # The || echo may be split across lines with backslash continuation in YAML.
-        # Normalize: remove backslashes and collapse whitespace.
-        cmd_normalized = " ".join(cmd.replace("\\", " ").split())
-        assert bool(re.search(r"\|\|\s*echo", cmd_normalized)) or "continue-on-error" in step, (
-            "dependency PR step must be best-effort (|| echo or continue-on-error)"
-        )
-
-
-# ============================================================================
-# sso-bridge ci.yml — spec validation + PR size
-# ============================================================================
-
-
-class TestSsoBridgeCiWorkflow:
-    @pytest.fixture
-    def workflow(self) -> dict:
-        return _load_workflow(_SSO_BRIDGE, "ci.yml")
-
-    def test_has_spec_validation_step(self, workflow: dict) -> None:
-        steps = _get_step_names(workflow["jobs"]["validate"])
-        assert any("Validate spec file" in s for s in steps)
-
-    def test_has_pr_size_check_step(self, workflow: dict) -> None:
-        steps = _get_step_names(workflow["jobs"]["validate"])
-        assert any("Check PR size" in s for s in steps)
-
-    def test_spec_validation_sets_task_prefix(self, workflow: dict) -> None:
-        step = _find_step(workflow["jobs"]["validate"], "Validate spec file")
-        assert step is not None
-        env = step.get("env", {})
-        assert env.get("DEVX_TASK_PREFIX") == "SSO"
-
-
-# ============================================================================
-# sso-bridge post-merge.yml — auto-publish + auto-create dependency PR
-# ============================================================================
-
-
-class TestSsoBridgePostMergeWorkflow:
-    @pytest.fixture
-    def workflow(self) -> dict:
-        return _load_workflow(_SSO_BRIDGE, "post-merge.yml")
+        return _load_workflow("post-merge.yml")

    def test_post_merge_workflow_exists(self, workflow: dict) -> None:
        assert workflow is not None

    def test_has_release_and_maintain_job(self, workflow: dict) -> None:
-        assert "release-and-maintain" in workflow["jobs"]
-
-    def test_has_create_dependency_pr_step(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("release-and-maintain", {})
-        step = _find_step(job, "Create infra dependency PR")
-        assert step is not None
-
-    def test_dependency_pr_uses_correct_module(self, workflow: dict) -> None:
-        job = workflow["jobs"].get("release-and-maintain", {})
-        step = _find_step(job, "Create infra dependency PR")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        assert "devx.ci.create_dependency_pr" in cmd
-        assert "--package sso_bridge" in cmd
-        assert "--repo oblachno/infra" in cmd
-
-    def test_dependency_pr_is_best_effort(self, workflow: dict) -> None:
-        import re
-
-        job = workflow["jobs"].get("release-and-maintain", {})
-        step = _find_step(job, "Create infra dependency PR")
-        assert step is not None
-        cmd = _get_run_commands(step)
-        # The || echo may be split across lines with backslash continuation in YAML.
-        cmd_normalized = " ".join(cmd.replace("\\", " ").split())
-        assert bool(re.search(r"\|\|\s*echo", cmd_normalized)) or "continue-on-error" in step
+        assert "release-and-maintain" in workflow["jobs"], "post-merge must have 'release-and-maintain' job"

    def test_has_publish_step(self, workflow: dict) -> None:
        job = workflow["jobs"].get("release-and-maintain", {})
        steps = _get_step_names(job)
-        assert any("publish" in s.lower() for s in steps), "sso-bridge post-merge must have a publish step"
+        assert any("publish" in s.lower() for s in steps), "post-merge must have a publish step"


 # ============================================================================
-# devx ci.yml — spec validation + PR size
-# ============================================================================
-
-
-class TestDevxCiWorkflow:
-    @pytest.fixture
-    def workflow(self) -> dict:
-        return _load_workflow(_DEVX, "ci.yml")
-
-    def test_has_spec_validation_step(self, workflow: dict) -> None:
-        steps = _get_step_names(workflow["jobs"]["validate"])
-        assert any("Validate spec file" in s for s in steps)
-
-    def test_has_pr_size_check_step(self, workflow: dict) -> None:
-        steps = _get_step_names(workflow["jobs"]["validate"])
-        assert any("Check PR size" in s for s in steps)
-
-    def test_spec_validation_sets_task_prefix(self, workflow: dict) -> None:
-        step = _find_step(workflow["jobs"]["validate"], "Validate spec file")
-        assert step is not None
-        env = step.get("env", {})
-        assert env.get("DEVX_TASK_PREFIX") == "DEVX"
-
-
-# ============================================================================
-# Skill files — spec-driven-development SKILL.md in all repos
+# Skill files — spec-driven-development SKILL.md in devx
 # ============================================================================


@@ -440,227 +142,96 @@ class TestSpecDrivenDevelopmentSkill:
        "## Acceptance Criteria",
    ]

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_skill_exists_in_repo(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        skill_path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
-        assert skill_path.exists(), f"SKILL.md not found in {repo_name}"
+    def test_skill_exists_in_repo(self) -> None:
+        skill_path = _DEVX / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
+        assert skill_path.exists(), "SKILL.md not found in devx"

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_skill_has_required_sections(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        skill_path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
-        content = skill_path.read_text(encoding="utf-8")
+    def test_skill_has_required_sections(self) -> None:
+        content = _read_skill("spec-driven-development")
        for section in self.REQUIRED_SECTIONS:
-            assert section in content, f"SKILL.md in {repo_name} missing section: {section}"
+            assert section in content, f"SKILL.md missing section: {section}"

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_skill_mentions_req_ids(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        skill_path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
-        content = skill_path.read_text(encoding="utf-8")
-        assert "REQ-" in content, f"SKILL.md in {repo_name} must mention REQ-ID format"
+    def test_skill_mentions_req_ids(self) -> None:
+        content = _read_skill("spec-driven-development")
+        assert "REQ-" in content, "SKILL.md must mention REQ-ID format"

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_skill_mentions_pr_size_limit(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        skill_path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
-        content = skill_path.read_text(encoding="utf-8")
-        assert "500" in content, f"SKILL.md in {repo_name} must mention 500 line PR size limit"
+    def test_skill_mentions_pr_size_limit(self) -> None:
+        content = _read_skill("spec-driven-development")
+        assert "500" in content, "SKILL.md must mention 500 line PR size limit"

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_skill_mentions_nightly_gate(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        skill_path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
-        content = skill_path.read_text(encoding="utf-8")
-        assert "nightly" in content.lower(), f"SKILL.md in {repo_name} must mention nightly gate"
-
-    def test_skill_exists_in_shared_dir(self) -> None:
-        skill_path = _OBLACHNO_ROOT / ".devin" / "skills" / "spec-driven-development" / "SKILL.md"
-        if not skill_path.exists():
-            pytest.skip("Shared .devin/skills/ not found (CI only checks out devx repo)")
-        assert skill_path.exists(), "SKILL.md not found in shared .devin/skills/"
+    def test_skill_mentions_nightly_gate(self) -> None:
+        content = _read_skill("spec-driven-development")
+        assert "nightly" in content.lower(), "SKILL.md must mention nightly gate"


 # ============================================================================
-# devx-workflow skill — exists in repos with PR workflow, mentions spec gates
+# devx-workflow skill — exists in devx, mentions spec gates
 # ============================================================================


 class TestDevxWorkflowSkill:
-    # Repos that have a PR workflow and need the devx-workflow skill
-    REPOS_WITH_PR_WORKFLOW = ["infra", "grm", "sso-bridge", "devx"]
+    def test_skill_exists(self) -> None:
+        path = _DEVX / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
+        assert path.exists(), "devx-workflow SKILL.md not found in devx"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_skill_exists(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        assert path.exists(), f"devx-workflow SKILL.md not found in {repo_name}"
+    def test_mentions_spec_validation(self) -> None:
+        content = _read_skill("devx-workflow")
+        assert "validate_spec" in content, "devx-workflow skill must mention validate_spec"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_spec_validation(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "validate_spec" in content, f"devx-workflow skill in {repo_name} must mention validate_spec"
+    def test_mentions_pr_size_check(self) -> None:
+        content = _read_skill("devx-workflow")
+        assert "check_pr_size" in content, "devx-workflow skill must mention check_pr_size"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_pr_size_check(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "check_pr_size" in content, f"devx-workflow skill in {repo_name} must mention check_pr_size"
-
-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_pr_workflow_commands(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
+    def test_mentions_pr_workflow_commands(self) -> None:
+        content = _read_skill("devx-workflow")
        assert "make create-pr" in content or "make push-with-pr" in content, (
-            f"devx-workflow skill in {repo_name} must mention PR creation commands"
+            "devx-workflow skill must mention PR creation commands"
        )

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_auto_merge(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
+    def test_mentions_auto_merge(self) -> None:
+        content = _read_skill("devx-workflow")
        assert "auto-merge" in content.lower() or "ready-to-merge" in content, (
-            f"devx-workflow skill in {repo_name} must mention auto-merge"
+            "devx-workflow skill must mention auto-merge"
        )

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_has_correct_task_prefix(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        """Each repo's devx-workflow skill must mention its correct task prefix."""
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        expected_prefixes = {
-            "infra": "OBL-INFRA",
-            "grm": "GRM",
-            "sso-bridge": "SSO",
-            "devx": "DEVX",
-        }
-        prefix = expected_prefixes[repo_name]
-        assert prefix in content, f"devx-workflow skill in {repo_name} must mention task prefix {prefix}"
-
-    def test_not_in_mattermost_oidc(self) -> None:
-        """mattermost-oidc has no PR workflow — should NOT have devx-workflow skill."""
-        path = _OBLACHNO_ROOT / "mattermost-oidc" / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        assert not path.exists(), "mattermost-oidc should NOT have devx-workflow skill (no PR workflow)"
-
-    # Repo-specific content checks
-    def test_infra_mentions_nightly_gate(self) -> None:
-        _skip_if_repo_missing("infra")
-        path = _OBLACHNO_ROOT / "infra" / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "nightly" in content.lower(), "infra devx-workflow skill must mention nightly gate"
-        assert "nightly_gate" in content, "infra devx-workflow skill must mention devx.ci.nightly_gate module"
-
-    def test_infra_mentions_fast_molecule(self) -> None:
-        _skip_if_repo_missing("infra")
-        path = _OBLACHNO_ROOT / "infra" / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "fast_molecule" in content, "infra devx-workflow skill must mention devx.ci.fast_molecule"
-
-    def test_infra_mentions_auto_deploy_staging(self) -> None:
-        _skip_if_repo_missing("infra")
-        path = _OBLACHNO_ROOT / "infra" / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "staging" in content.lower(), "infra devx-workflow skill must mention staging auto-deploy"
-
-    def test_grm_mentions_dependency_pr(self) -> None:
-        _skip_if_repo_missing("grm")
-        path = _OBLACHNO_ROOT / "grm" / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "create_dependency_pr" in content, "grm devx-workflow skill must mention create_dependency_pr"
-
-    def test_sso_bridge_mentions_dependency_pr(self) -> None:
-        _skip_if_repo_missing("sso-bridge")
-        path = _OBLACHNO_ROOT / "sso-bridge" / ".devin" / "skills" / "devx-workflow" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "create_dependency_pr" in content, "sso-bridge devx-workflow skill must mention create_dependency_pr"
+    def test_has_correct_task_prefix(self) -> None:
+        content = _read_skill("devx-workflow")
+        assert "DEVX" in content, "devx-workflow skill must mention task prefix DEVX"


 # ============================================================================
-# testing-and-debugging skill — exists in all repos, mentions spec workflow
+# testing-and-debugging skill — exists in devx, mentions spec workflow
 # ============================================================================


 class TestTestingAndDebuggingSkill:
-    # All repos have a testing-and-debugging skill
-    ALL_REPOS = ["infra", "grm", "sso-bridge", "devx", "mattermost-oidc"]
+    def test_skill_exists(self) -> None:
+        path = _DEVX / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
+        assert path.exists(), "testing-and-debugging SKILL.md not found in devx"

-    @pytest.mark.parametrize("repo_name", ALL_REPOS)
-    def test_skill_exists(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
-        assert path.exists(), f"testing-and-debugging SKILL.md not found in {repo_name}"
-
-    @pytest.mark.parametrize("repo_name", ALL_REPOS)
-    def test_has_required_sections(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        # All testing-and-debugging skills should have a CI failure investigation section
+    def test_has_required_sections(self) -> None:
+        content = _read_skill("testing-and-debugging")
        assert "CI Failure Investigation" in content or "CI failure" in content, (
-            f"testing-and-debugging skill in {repo_name} must have CI failure section"
+            "testing-and-debugging skill must have CI failure section"
        )

-    # Repos with PR workflow should mention spec-driven workflow
-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_mentions_spec_driven_workflow(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "spec" in content.lower(), (
-            f"testing-and-debugging skill in {repo_name} must mention spec-driven workflow"
-        )
-
-    def test_infra_mentions_nightly(self) -> None:
-        _skip_if_repo_missing("infra")
-        path = _OBLACHNO_ROOT / "infra" / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "nightly" in content.lower(), "infra testing-and-debugging skill must mention nightly tests"
-
-    def test_infra_mentions_fast_molecule(self) -> None:
-        _skip_if_repo_missing("infra")
-        path = _OBLACHNO_ROOT / "infra" / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "fast" in content.lower() and "molecule" in content.lower(), (
-            "infra testing-and-debugging skill must mention fast molecule"
-        )
-
-    def test_mattermost_oidc_no_spec_mention(self) -> None:
-        """mattermost-oidc has no spec-driven workflow — skill should NOT mention it."""
-        _skip_if_repo_missing("mattermost-oidc")
-        path = _OBLACHNO_ROOT / "mattermost-oidc" / ".devin" / "skills" / "testing-and-debugging" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        # mattermost-oidc has no PR workflow, no spec validation
-        assert "validate_spec" not in content, (
-            "mattermost-oidc testing-and-debugging skill should NOT mention validate_spec"
-        )
+    def test_mentions_spec_driven_workflow(self) -> None:
+        content = _read_skill("testing-and-debugging")
+        assert "spec" in content.lower(), "testing-and-debugging skill must mention spec-driven workflow"


 # ============================================================================
-# pr-review skill — deep review with auto-fix, exists in repos with PR workflow
+# pr-review skill — deep review with auto-fix, exists in devx
 # ============================================================================


 class TestPrReviewSkill:
-    REPOS_WITH_PR_WORKFLOW = ["infra", "grm", "sso-bridge", "devx"]
+    def test_skill_exists(self) -> None:
+        path = _DEVX / ".devin" / "skills" / "pr-review" / "SKILL.md"
+        assert path.exists(), "pr-review SKILL.md not found in devx"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_skill_exists(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        assert path.exists(), f"pr-review SKILL.md not found in {repo_name}"
-
-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_all_review_categories(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
+    def test_mentions_all_review_categories(self) -> None:
+        content = _read_skill("pr-review")
        required_categories = [
            "Functional Correctness",
            "Completeness",
@@ -672,56 +243,31 @@ class TestPrReviewSkill:
            "Test Quality",
        ]
        for cat in required_categories:
-            assert cat in content, f"pr-review skill in {repo_name} missing category: {cat}"
+            assert cat in content, f"pr-review skill missing category: {cat}"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_auto_fix(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "auto-fix" in content.lower() or "auto fix" in content.lower(), (
-            f"pr-review skill in {repo_name} must mention auto-fix"
-        )
+    def test_mentions_auto_fix(self) -> None:
+        content = _read_skill("pr-review")
+        assert "auto-fix" in content.lower() or "auto fix" in content.lower(), "pr-review skill must mention auto-fix"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_gitea_mcp(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "mcp" in content.lower(), f"pr-review skill in {repo_name} must mention Gitea MCP"
+    def test_mentions_gitea_mcp(self) -> None:
+        content = _read_skill("pr-review")
+        assert "mcp" in content.lower(), "pr-review skill must mention Gitea MCP"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_inline_comments(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "inline" in content.lower(), f"pr-review skill in {repo_name} must mention inline comments"
+    def test_mentions_inline_comments(self) -> None:
+        content = _read_skill("pr-review")
+        assert "inline" in content.lower(), "pr-review skill must mention inline comments"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_ready_to_merge(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "ready-to-merge" in content, f"pr-review skill in {repo_name} must mention ready-to-merge label"
+    def test_mentions_ready_to_merge(self) -> None:
+        content = _read_skill("pr-review")
+        assert "ready-to-merge" in content, "pr-review skill must mention ready-to-merge label"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_resolve_discussion(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "resolve" in content.lower(), f"pr-review skill in {repo_name} must mention resolving discussions"
+    def test_mentions_resolve_discussion(self) -> None:
+        content = _read_skill("pr-review")
+        assert "resolve" in content.lower(), "pr-review skill must mention resolving discussions"

-    @pytest.mark.parametrize("repo_name", REPOS_WITH_PR_WORKFLOW)
-    def test_mentions_summary(self, repo_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        content = path.read_text(encoding="utf-8")
-        assert "summary" in content.lower(), f"pr-review skill in {repo_name} must mention posting a summary"
-
-    def test_not_in_mattermost_oidc(self) -> None:
-        """mattermost-oidc has no PR workflow — should NOT have pr-review skill."""
-        path = _OBLACHNO_ROOT / "mattermost-oidc" / ".devin" / "skills" / "pr-review" / "SKILL.md"
-        assert not path.exists(), "mattermost-oidc should NOT have pr-review skill (no PR workflow)"
+    def test_mentions_summary(self) -> None:
+        content = _read_skill("pr-review")
+        assert "summary" in content.lower(), "pr-review skill must mention posting a summary"

    def test_no_pr_review_module_remains(self) -> None:
        """The old devx.ci.pr_review module should be deleted."""
@@ -734,102 +280,78 @@ class TestPrReviewSkill:
        assert not path.exists(), "tests/unit/test_pr_review.py should be deleted"

    def test_no_pr_review_in_workflows(self) -> None:
-        """No CI workflow should reference devx.ci.pr_review."""
-        for repo_name in ["infra", "grm", "sso-bridge", "devx"]:
-            wf_dir = _OBLACHNO_ROOT / repo_name / ".gitea" / "workflows"
-            if not wf_dir.exists():
-                continue
-            for wf_file in wf_dir.glob("*.yml"):
-                content = wf_file.read_text(encoding="utf-8")
-                assert "devx.ci.pr_review" not in content, (
-                    f"{repo_name}/{wf_file.name} still references devx.ci.pr_review"
-                )
+        """No devx CI workflow should reference devx.ci.pr_review."""
+        wf_dir = _DEVX / ".gitea" / "workflows"
+        if not wf_dir.exists():
+            pytest.skip("No workflows directory")
+        for wf_file in wf_dir.glob("*.yml"):
+            content = wf_file.read_text(encoding="utf-8")
+            assert "devx.ci.pr_review" not in content, f"{wf_file.name} still references devx.ci.pr_review"


 # ============================================================================
-# Skill consistency — all skills have proper structure
+# Skill consistency — all devx skills have proper structure
 # ============================================================================


 class TestSkillConsistency:
-    ALL_SKILLS = [
-        ("infra", "devx-workflow"),
-        ("infra", "testing-and-debugging"),
-        ("infra", "spec-driven-development"),
-        ("infra", "pr-review"),
-        ("grm", "devx-workflow"),
-        ("grm", "testing-and-debugging"),
-        ("grm", "spec-driven-development"),
-        ("grm", "pr-review"),
-        ("sso-bridge", "devx-workflow"),
-        ("sso-bridge", "testing-and-debugging"),
-        ("sso-bridge", "spec-driven-development"),
-        ("sso-bridge", "pr-review"),
-        ("devx", "devx-workflow"),
-        ("devx", "testing-and-debugging"),
-        ("devx", "spec-driven-development"),
-        ("devx", "pr-review"),
-        ("mattermost-oidc", "testing-and-debugging"),
+    DEVX_SKILLS = [
+        "devx-workflow",
+        "testing-and-debugging",
+        "spec-driven-development",
+        "pr-review",
    ]

-    @pytest.mark.parametrize("repo_name, skill_name", ALL_SKILLS)
-    def test_skill_has_title(self, repo_name: str, skill_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / skill_name / "SKILL.md"
+    @pytest.mark.parametrize("skill_name", DEVX_SKILLS)
+    def test_skill_has_title(self, skill_name: str) -> None:
+        path = _DEVX / ".devin" / "skills" / skill_name / "SKILL.md"
+        assert path.exists(), f"SKILL.md not found for {skill_name}"
        content = path.read_text(encoding="utf-8")
        first_line = content.strip().split("\n")[0]
-        assert first_line.startswith("# "), f"{repo_name}/{skill_name}: SKILL.md must start with a # title"
+        assert first_line.startswith("# "), f"{skill_name}: SKILL.md must start with a # title"

-    @pytest.mark.parametrize("repo_name, skill_name", ALL_SKILLS)
-    def test_skill_not_empty(self, repo_name: str, skill_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / skill_name / "SKILL.md"
+    @pytest.mark.parametrize("skill_name", DEVX_SKILLS)
+    def test_skill_not_empty(self, skill_name: str) -> None:
+        path = _DEVX / ".devin" / "skills" / skill_name / "SKILL.md"
+        assert path.exists(), f"SKILL.md not found for {skill_name}"
        content = path.read_text(encoding="utf-8").strip()
-        assert len(content) > 100, f"{repo_name}/{skill_name}: SKILL.md is too short ({len(content)} chars)"
+        assert len(content) > 100, f"{skill_name}: SKILL.md is too short ({len(content)} chars)"

-    @pytest.mark.parametrize("repo_name, skill_name", ALL_SKILLS)
-    def test_skill_has_sections(self, repo_name: str, skill_name: str) -> None:
-        _skip_if_repo_missing(repo_name)
-        path = _OBLACHNO_ROOT / repo_name / ".devin" / "skills" / skill_name / "SKILL.md"
+    @pytest.mark.parametrize("skill_name", DEVX_SKILLS)
+    def test_skill_has_sections(self, skill_name: str) -> None:
+        path = _DEVX / ".devin" / "skills" / skill_name / "SKILL.md"
+        assert path.exists(), f"SKILL.md not found for {skill_name}"
        content = path.read_text(encoding="utf-8")
-        # Must have at least 2 ## sections
        section_count = content.count("\n## ")
-        assert section_count >= 2, (
-            f"{repo_name}/{skill_name}: SKILL.md must have at least 2 sections (found {section_count})"
-        )
+        assert section_count >= 2, f"{skill_name}: SKILL.md must have at least 2 sections (found {section_count})"


 # ============================================================================
-# AGENTS.md — spec-driven development section in all repos
+# AGENTS.md — spec-driven development section in devx
 # ============================================================================


 class TestAgentsMdSpecSection:
-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_agents_md_has_spec_driven_section(self, repo_name: str) -> None:
-        path = _OBLACHNO_ROOT / repo_name / "AGENTS.md"
+    def test_agents_md_has_spec_driven_section(self) -> None:
+        path = _DEVX / "AGENTS.md"
        if not path.exists():
-            pytest.skip(f"AGENTS.md not found in {repo_name}")
+            pytest.skip("AGENTS.md not found in devx")
        content = path.read_text(encoding="utf-8")
-        assert "## Spec-Driven Development" in content, (
-            f"AGENTS.md in {repo_name} must have '## Spec-Driven Development' section"
-        )
+        assert "## Spec-Driven Development" in content, "AGENTS.md must have '## Spec-Driven Development' section"

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_agents_md_mentions_validate_spec(self, repo_name: str) -> None:
-        path = _OBLACHNO_ROOT / repo_name / "AGENTS.md"
+    def test_agents_md_mentions_validate_spec(self) -> None:
+        path = _DEVX / "AGENTS.md"
        if not path.exists():
-            pytest.skip(f"AGENTS.md not found in {repo_name}")
+            pytest.skip("AGENTS.md not found in devx")
        content = path.read_text(encoding="utf-8")
        assert "validate_spec" in content or "devx.ci.validate_spec" in content, (
-            f"AGENTS.md in {repo_name} must mention devx.ci.validate_spec"
+            "AGENTS.md must mention devx.ci.validate_spec"
        )

-    @pytest.mark.parametrize("repo_name", ["infra", "grm", "sso-bridge", "devx"])
-    def test_agents_md_pr_workflow_section_intact(self, repo_name: str) -> None:
+    def test_agents_md_pr_workflow_section_intact(self) -> None:
        """Ensure the PR Workflow section wasn't accidentally deleted."""
-        path = _OBLACHNO_ROOT / repo_name / "AGENTS.md"
+        path = _DEVX / "AGENTS.md"
        if not path.exists():
-            pytest.skip(f"AGENTS.md not found in {repo_name}")
+            pytest.skip("AGENTS.md not found in devx")
        content = path.read_text(encoding="utf-8")
-        assert "## PR Workflow" in content, f"AGENTS.md in {repo_name} must still have '## PR Workflow' section"
+        assert "## PR Workflow" in content, "AGENTS.md must still have '## PR Workflow' section"
@@ -30,6 +30,7 @@ class TestHelpers:
        assert CONVENTIONAL_RE.match("test: add tests")
        assert CONVENTIONAL_RE.match("ci: update workflow")
        assert CONVENTIONAL_RE.match("build: update deps")
+        assert CONVENTIONAL_RE.match("deps: bump devx from v0.50.2 to v0.51.0")
        assert CONVENTIONAL_RE.match("revert: undo change")

    def test_conventional_re_allows_scope(self) -> None:
Author	SHA1	Message	Date
gitea-actions-bot	87d46226f6	chore: update badge URLs to commit `09be7662` [skip ci]	2026-09-05 14:18:15 +00:00
emil	4638e334b5	DEVX-167: docs: add dependency-graph, deployment-coordination, and skill-creation skills Post-merge / detect-and-configure (push) Successful in 20s Details Post-merge / release-and-maintain (push) Successful in 54s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-09-05 14:16:52 +00:00
gitea-actions-bot	c6bd4e8f63	chore: update badge URLs to commit `27d2b933` [skip ci]	2026-08-26 18:12:15 +00:00
devx-ci-bot	d47e3833bc	release: v0.51.9 [skip ci]	2026-08-26 18:11:18 +00:00
emil	c00e9e3d7b	DEVX-166: fix: exclude docs/plans/* from PR size check Post-merge / detect-and-configure (push) Successful in 13s Details Post-merge / release-and-maintain (push) Successful in 1m25s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-26 18:10:34 +00:00
gitea-actions-bot	40e95bc96f	chore: update badge URLs to commit `ae0cb5b8` [skip ci]	2026-08-26 18:06:00 +00:00
devx-ci-bot	3aa9681404	release: v0.51.8 [skip ci]	2026-08-26 18:04:45 +00:00
emil	e96f63cb40	DEVX-165: fix: accept deps: as valid conventional commit type Post-merge / detect-and-configure (push) Successful in 14s Details Post-merge / release-and-maintain (push) Successful in 1m46s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-26 18:03:57 +00:00
gitea-actions-bot	6d6c8cceec	chore: update badge URLs to commit `2f14bdfd` [skip ci]	2026-08-26 14:29:30 +00:00
devx-ci-bot	d9489b5387	release: v0.51.7 [skip ci]	2026-08-26 14:28:39 +00:00
kireto	35f7bc92cd	DEVX-164: fix: increase HTTP 500 retry count to 5 with longer backoff and visible logging Post-merge / detect-and-configure (push) Successful in 11s Details Post-merge / release-and-maintain (push) Successful in 1m20s Details	2026-08-26 14:27:57 +00:00
gitea-actions-bot	55bcd8fa01	chore: update badge URLs to commit `f474ba2f` [skip ci]	2026-08-26 14:11:33 +00:00
devx-ci-bot	990f70845c	release: v0.51.6 [skip ci]	2026-08-26 14:10:44 +00:00
kireto	149e8846b8	DEVX-163: fix: use stderr=STDOUT to capture all docker push output in one stream Post-merge / detect-and-configure (push) Successful in 13s Details Post-merge / release-and-maintain (push) Successful in 1m18s Details	2026-08-26 14:09:59 +00:00
gitea-actions-bot	a7cdebc0dc	chore: update badge URLs to commit `73dcdbaf` [skip ci]	2026-08-26 13:42:00 +00:00
devx-ci-bot	012f0979ce	release: v0.51.5 [skip ci]	2026-08-26 13:41:09 +00:00
kireto	62412755cb	DEVX-163: fix: check stdout for HTTP 500 in _run_push (docker sends to stdout) Post-merge / release-and-maintain (push) Successful in 1m20s Details Post-merge / detect-and-configure (push) Successful in 12s Details	2026-08-26 13:40:24 +00:00
gitea-actions-bot	25f00335df	chore: update badge URLs to commit `7660d501` [skip ci]	2026-08-26 13:14:22 +00:00
devx-ci-bot	fa32df2f22	release: v0.51.4 [skip ci]	2026-08-26 13:13:27 +00:00
kireto	2d7b4bdac3	DEVX-162: fix: serialize registry uploads and retry on HTTP 500 Post-merge / detect-and-configure (push) Successful in 12s Details Post-merge / release-and-maintain (push) Successful in 1m22s Details	2026-08-26 13:12:45 +00:00
gitea-actions-bot	5986b5b9ed	chore: update badge URLs to commit `b1023118` [skip ci]	2026-08-26 08:27:13 +00:00
emil	34c7f3782c	DEVX-160: refactor: remove cross-repo contract tests from devx Post-merge / detect-and-configure (push) Successful in 11s Details Post-merge / release-and-maintain (push) Successful in 53s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-26 08:26:05 +00:00
gitea-actions-bot	e123d7050f	chore: update badge URLs to commit `c133ea40` [skip ci]	2026-08-26 08:24:10 +00:00
devx-ci-bot	8b8e7eb7f5	release: v0.51.3 [skip ci]	2026-08-26 08:13:00 +00:00
emil	dcfbd4c0c2	DEVX-161: fix: fall back to CI bot token for auto-merge approval Post-merge / detect-and-configure (push) Successful in 14s Details Post-merge / release-and-maintain (push) Canceled after 13m38s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-26 08:12:00 +00:00
gitea-actions-bot	48122876ba	chore: update badge URLs to commit `1a5ea7fe` [skip ci]	2026-08-26 07:48:15 +00:00