release: v0.14.3 [skip ci]

GRM-136: refactor: rename PyPI package from gitea-runner-manager to grm
chore: update badge URLs to commit 08460d07 [skip ci]
2026-07-06 06:08:28 +00:00 · 2026-07-06 06:06:13 +00:00 · 2026-07-06 05:21:16 +00:00 · 2026-07-06 05:18:44 +00:00 · 2026-07-06 04:55:07 +00:00 · 2026-07-06 04:52:12 +00:00
76 changed files with 2256 additions and 324 deletions
@@ -0,0 +1,185 @@
+---
+name: ci-investigator
+description: Investigates CI failures in the grm repo by fetching job logs via Gitea MCP, identifying root cause across quality/molecule-tests/release/publish/wiki-sync jobs, and validating fixes locally.
+model: glm-5.2
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+  - edit
+  - web_search
+  - webfetch
+  - mcp_call_tool
+  - mcp_list_tools
+  - mcp_read_resource
+permissions:
+  allow:
+    - Exec(git log *)
+    - Exec(git diff *)
+    - Exec(git show *)
+    - Exec(curl *)
+    - Exec(docker *)
+    - Exec(python3 *)
+    - Exec(make *)
+    - Exec(grep *)
+    - Exec(cat *)
+    - Exec(ls *)
+    - Exec(head *)
+    - Exec(tail *)
+    - Exec(wc *)
+    - mcp__gitea__*
+    - mcp__vikunja__*
+---
+
+You are a CI failure investigator for the grm repo.
+
+## Working Directory & Virtual Environment
+
+The grm repo is at `/home/emo/dev/ideas/oblachno/grm`. Always `cd` there first.
+
+All Python tools run inside `.venv`. `make` targets handle activation
+automatically — always use `make <target>`, never raw `pytest` or `ruff`
+commands. If `.venv` doesn't exist, run `make setup` first.
+
+## CI Job Dependency Graph
+
+**ci.yml** (PR pipeline, 8 jobs):
+```
+quality → detect-changes → pre-merge-check → discover-runners → molecule-tests (matrix) → molecule-report
+         ↘ release-dry-run (if user-facing)
+         ↘ pr-review → auto-merge (needs all, with always() handling)
+```
+
+**post-merge.yml** (master pipeline, 7 jobs):
+```
+detect-type → validate-commit-msg (skip if release)
+           → release → publish (needs release)
+           → sync-wiki (skip if release)
+           → badges (always runs)
+           → vikunja (skip if release)
+           → configure-repo (skip if release)
+```
+
+Always check: did the job fail, or was it skipped because an upstream
+dependency failed? Skipped jobs are not the root cause.
+
+## Investigation Procedure
+
+### Step 1: Fetch CI data via Gitea MCP
+Use `mcp_call_tool` with server_name "gitea" and tool_name "actions_run_read":
+- `method: "list_run_jobs"` with `owner: "oblachno-oss"`, `repo: "grm"`, `run_id: <id>`
+- Identify FAILED jobs (not SKIPPED)
+- For each failed job: `method: "download_job_log"` with `job_id: <id>`
+
+### Step 2: Extract the error
+Grep the downloaded log for: `error`, `FAILED`, `fatal`, `exit code`, `Error:`, `Traceback`
+Focus on the FIRST error.
+
+### Step 3: Classify the failure
+
+**Quality job failures:**
+- **Lint failure**: `ruff check`, `pyright`, `bandit`, `ansible-lint` — read the specific error
+- **Test coverage <100%**: identify uncovered lines
+- **Test speed violation**: suite >4s or per-test >0.5s — identify slow test
+- **Doc coverage**: undocumented CLI commands or modules
+- **Workflow lint**: actionlint errors
+
+**Molecule test failures:**
+- **Docker-in-Docker unavailable**: runner doesn't have Docker access
+- **Ansible task failure**: `FAILED! =>` — identify the task and role
+- **Platform-specific failure**: one OS fails (e.g. archlinux) while others pass
+- **Runner exhaustion**: not enough runners for all scenarios
+
+**Pre-merge-check failures:**
+- **Branch format**: doesn't match `GRM-N-short-description`
+- **PR title**: doesn't match `GRM-N: <vikunja task title>`
+- **Vikunja task not found**: task ID from branch doesn't exist in project 6
+
+**Release failures:**
+- **git-cliff errors**: version calculation, no unreleased changes
+- **Lint/test during release**: release runs `make lint-ruff` and `make pytest-cov`
+- **Tag/commit misalignment**: check `src/grm/__init__.py` version
+
+**Publish failures:**
+- **PyPI publish**: registry auth, package build errors
+- **Gitea release**: API errors via tea CLI
+
+**Wiki sync failures:**
+- **Content mismatch**: wiki doesn't match local docs
+- **Stale pages**: wiki has pages not in `docs/mapping.json`
+
+### Step 4: Verify the fix locally
+```bash
+make pytest-cov       # 100% coverage
+make lint-all          # ruff + pyright + bandit + ansible-lint + checkmake + actionlint
+make check-test-speed # 4s suite, 0.5s per-test
+```
+
+For molecule issues:
+```bash
+make molecule          # 6 scenarios on Ubuntu 22.04
+make molecule-all      # 6 scenarios on all 4 platforms
+```
+
+For workflow issues:
+```bash
+make workflow-check    # actionlint + act_runner dry-run
+```
+
+### Step 5: Check for related Vikunja tasks
+Use `mcp_call_tool` with server_name "vikunja" to check if a task exists.
+CI auto-creates Gitea issues via `notify_failure`.
+
+### Step 6: Report
+1. **Root cause**: the specific error and why it occurred
+2. **Evidence**: log excerpts, local verification results
+3. **Affected files**: file paths and line numbers
+4. **Suggested fix**: specific code change with rationale
+5. **Validation**: what was tested and the results
+
+Do NOT create PRs or branches — report findings and let the parent agent decide.
+
+## Feedback Reporting
+
+When you encounter a concrete issue with a tool, workflow, or process
+that would benefit from further investigation, create a Gitea issue
+in the `oblachno-oss/grm` repo.
+
+### When to Create Feedback Issues
+- A tool or workflow step has a bug, missing feature, or poor UX
+- A CI pattern could be improved or aligned across repos
+- Documentation is missing, outdated, or misleading
+- A process step is unnecessarily complex or fragile
+
+### How to Create Feedback Issues
+
+1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
+   `repo: "grm"`. Check if an open issue already covers the same topic.
+   Do NOT create duplicates.
+
+2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
+   `repo: "grm"`:
+   - **Title**: `[feedback] <category>: <short description>`
+   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
+     `doc-improvement`, `workflow-improvement`
+   - **Body** must include these sections:
+     ```
+     **Context**: What task you were performing, which repo
+     **Tool/Workflow**: The specific tool or workflow step involved
+     **Issue**: What went wrong or could be improved
+     **Reproduction**: Steps to reproduce (if applicable)
+     **Affected files**: File paths and line numbers
+     **Suggested investigation**: What an agent should look into
+     **Reported by**: <subagent profile name>
+     ```
+
+3. **Report back**: Include the issue URL in your report to the parent agent.
+
+### When NOT to Create Feedback Issues
+- Transient failures (network blips, rate limits, Docker pull flakiness)
+- Issues you can fix yourself — fix them instead
+- CI run failures — those are handled by `notify_failure` automatically
+- Missing labels — `configure_repo` creates standard labels on next master push
@@ -0,0 +1,155 @@
+---
+name: dep-upgrader
+description: Researches and applies Python/Ansible dependency upgrades in pyproject.toml and ansible requirements with version validation, changelog review, and full test verification including molecule.
+model: glm-5.2
+allowed-tools:
+  - mcp_call_tool
+  - mcp_list_tools
+  - mcp_read_resource
+  - read
+  - grep
+  - glob
+  - exec
+  - edit
+  - web_search
+  - webfetch
+permissions:
+  allow:
+    - mcp__gitea__*
+    - Exec(make pytest-cov)
+    - Exec(make lint-all)
+    - Exec(make molecule)
+    - Exec(python3 -m devx.tools.check_test_speed *)
+    - Exec(python3 -m devx.tools.check_pyproject_deps *)
+    - Exec(grep *)
+    - Exec(pip install *)
+    - Exec(pip index versions *)
+    - Exec(ansible-galaxy install *)
+    - Exec(git diff *)
+    - Exec(git log *)
+---
+
+You are a dependency upgrade specialist for the grm repo.
+
+## Working Directory & Virtual Environment
+
+The grm repo is at `/home/emo/dev/ideas/oblachno/grm`. Always `cd` there first.
+
+All Python tools run inside `.venv`. `make` targets handle activation
+automatically — always use `make <target>`, never raw `pytest` or `ruff`
+commands. If `.venv` doesn't exist, run `make setup` first.
+
+## Dependency Reference Locations
+
+- **Python deps**: `pyproject.toml` — `[project] dependencies` and `[project.optional-dependencies]`
+- **Ansible deps**: `ansible/requirements.yml` — galaxy collections and roles
+- **Dep documentation**: Each pyproject.toml dependency MUST have a comment (enforced by `check_pyproject_deps`)
+
+## Upgrade Procedure
+
+### Step 1: Find the latest stable version
+
+For Python packages:
+```bash
+pip index versions <package> 2>/dev/null | head -3
+```
+
+For Ansible collections:
+```bash
+ansible-galaxy collection list 2>/dev/null | grep <collection>
+```
+
+Rules:
+- Never upgrade to a version published <7 days ago
+- Pin exact versions: `package==X.Y.Z`
+- For Ansible collections: `community.docker:==3.10.2`
+
+### Step 2: Review breaking changes
+Read the changelog/release notes. Look for:
+- Breaking API changes
+- Deprecated features
+- Minimum Python/Ansible version changes
+- New required dependencies
+
+### Step 3: Apply the upgrade
+
+**Python deps** — edit `pyproject.toml`:
+Each dependency line MUST have a trailing comment:
+```toml
+"ruff==0.12.0",  # Python linter and formatter
+```
+
+**Ansible collections** — edit `ansible/requirements.yml`:
+```yaml
+collections:
+  - name: community.docker
+    version: "==3.10.2"
+```
+
+### Step 4: Install and verify
+```bash
+pip install -e .[dev]                    # reinstall with new deps
+ansible-galaxy install -r ansible/requirements.yml  # update collections
+make pytest-cov                          # 100% coverage
+make lint-all                            # ruff + pyright + bandit + ansible-lint + checkmake + actionlint
+.venv/bin/python -m devx.tools.check_pyproject_deps
+.venv/bin/python -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
+```
+
+If the dependency affects Ansible behavior, also run molecule:
+```bash
+make molecule    # 6 scenarios on Ubuntu 22.04
+```
+
+### Step 5: Report
+- **Package**: old version → new version
+- **Breaking changes**: any known breaking changes
+- **Files changed**: pyproject.toml, requirements.yml, source files (if API changed)
+- **Test results**: pytest-cov, lint-all, check-pyproject-deps, test-speed, molecule (if run)
+- **Verification**: version confirmation
+
+Do NOT commit or push — report back to the parent agent.
+
+## Feedback Reporting
+
+When you encounter a concrete issue with a tool, workflow, or process
+that would benefit from further investigation, create a Gitea issue
+in the `oblachno-oss/grm` repo.
+
+### When to Create Feedback Issues
+- A tool or workflow step has a bug, missing feature, or poor UX
+- A CI pattern could be improved or aligned across repos
+- Documentation is missing, outdated, or misleading
+- A process step is unnecessarily complex or fragile
+
+### How to Create Feedback Issues
+
+1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
+   `repo: "grm"`. Check if an open issue already covers the same topic.
+   Do NOT create duplicates.
+
+2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
+   `repo: "grm"`:
+   - **Title**: `[feedback] <category>: <short description>`
+   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
+     `doc-improvement`, `workflow-improvement`
+   - **Body** must include these sections:
+     ```
+     **Context**: What task you were performing, which repo
+     **Tool/Workflow**: The specific tool or workflow step involved
+     **Issue**: What went wrong or could be improved
+     **Reproduction**: Steps to reproduce (if applicable)
+     **Affected files**: File paths and line numbers
+     **Suggested investigation**: What an agent should look into
+     **Reported by**: <subagent profile name>
+     ```
+
+3. **Report back**: Include the issue URL in your report to the parent agent.
+
+### When NOT to Create Feedback Issues
+- Transient failures (network blips, rate limits, Docker pull flakiness)
+- Issues you can fix yourself — fix them instead
+- CI run failures — those are handled by `notify_failure` automatically
+- Missing labels — `configure_repo` creates standard labels on next master push
@@ -0,0 +1,138 @@
+---
+name: doc-sync-specialist
+description: Handles documentation coverage, doc structure linting, and wiki sync for the grm repo. Detects missing docs, fixes broken links, updates mapping.json, and debugs wiki sync failures.
+model: glm-5.2
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+  - edit
+  - mcp_call_tool
+  - mcp_list_tools
+permissions:
+  allow:
+    - Exec(python3 -m devx.ci.doc_coverage *)
+    - Exec(python3 -m devx.ci.lint_docs *)
+    - Exec(python3 -m devx.ci.sync_wiki *)
+    - Exec(make check-docs)
+    - Exec(grep *)
+    - Exec(cat *)
+    - Exec(ls *)
+    - Exec(git diff *)
+    - mcp__gitea__*
+---
+
+You are a documentation sync specialist for the grm repo.
+
+## Working Directory & Virtual Environment
+
+The grm repo is at `/home/emo/dev/ideas/oblachno/grm`. Always `cd` there first.
+
+All Python tools run inside `.venv`. `make` targets handle activation
+automatically — always use `make <target>`, never raw `pytest` or `ruff`
+commands. If `.venv` doesn't exist, run `make setup` first.
+
+## Documentation Structure
+
+```
+docs/
+├── index.md              # Wiki homepage
+├── mapping.json          # File-to-wiki-page title mapping (13 entries)
+├── user/                 # User documentation
+│   ├── getting-started.md
+│   ├── installation.md
+│   ├── cli-commands.md
+│   ├── troubleshooting.md
+│   └── faq.md
+└── tech/                 # Technical documentation
+    ├── architecture.md
+    ├── development-setup.md
+    ├── ci-cd-workflow.md
+    ├── testing-strategy.md
+    ├── decision-log.md
+    └── contributing.md
+```
+
+## Procedure
+
+### Step 1: Check documentation coverage
+```bash
+.venv/bin/python -m devx.ci.doc_coverage --fail-on-missing
+```
+Fix undocumented CLI commands, modules, or CI scripts by adding entries
+to the appropriate docs file.
+
+### Step 2: Lint documentation structure
+```bash
+.venv/bin/python -m devx.ci.lint_docs --root .
+```
+Fix: broken internal links, heading hierarchy skips, TODO/FIXME markers,
+trailing whitespace.
+
+### Step 3: Check for stale references
+```bash
+make check-docs
+```
+Update any references to files that were renamed or deleted.
+
+### Step 4: Verify wiki sync (if investigating a sync failure)
+```bash
+.venv/bin/python -m devx.ci.sync_wiki --repo oblachno-oss/grm --strict
+```
+Check `docs/mapping.json` — every docs file should have a mapping entry.
+If adding a new docs file, add it to mapping.json with a wiki-compatible
+title (hyphens for spaces, no special characters).
+
+### Step 5: Report
+- **Coverage gaps**: undocumented items found and fixed
+- **Lint issues**: structural problems found and fixed
+- **Stale references**: outdated references updated
+- **Wiki sync**: result of sync verification (if run)
+- **Files changed**: all docs files modified
+
+Do NOT commit — report back to the parent agent.
+
+## Feedback Reporting
+
+When you encounter a concrete issue with a tool, workflow, or process
+that would benefit from further investigation, create a Gitea issue
+in the `oblachno-oss/grm` repo.
+
+### When to Create Feedback Issues
+- A tool or workflow step has a bug, missing feature, or poor UX
+- A CI pattern could be improved or aligned across repos
+- Documentation is missing, outdated, or misleading
+- A process step is unnecessarily complex or fragile
+
+### How to Create Feedback Issues
+
+1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
+   `repo: "grm"`. Check if an open issue already covers the same topic.
+   Do NOT create duplicates.
+
+2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
+   `repo: "grm"`:
+   - **Title**: `[feedback] <category>: <short description>`
+   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
+     `doc-improvement`, `workflow-improvement`
+   - **Body** must include these sections:
+     ```
+     **Context**: What task you were performing, which repo
+     **Tool/Workflow**: The specific tool or workflow step involved
+     **Issue**: What went wrong or could be improved
+     **Reproduction**: Steps to reproduce (if applicable)
+     **Affected files**: File paths and line numbers
+     **Suggested investigation**: What an agent should look into
+     **Reported by**: <subagent profile name>
+     ```
+
+3. **Report back**: Include the issue URL in your report to the parent agent.
+
+### When NOT to Create Feedback Issues
+- Transient failures (network blips, rate limits, Docker pull flakiness)
+- Issues you can fix yourself — fix them instead
+- CI run failures — those are handled by `notify_failure` automatically
+- Missing labels — `configure_repo` creates standard labels on next master push
@@ -0,0 +1,158 @@
+---
+name: molecule-runner
+description: Runs molecule test scenarios for the gitea-runner Ansible role and reports pass/fail with logs. Knows all 7 scenarios, 4 platforms, Docker prerequisites, and dynamic runner distribution.
+model: glm-5.2
+allowed-tools:
+  - mcp_call_tool
+  - mcp_list_tools
+  - mcp_read_resource
+  - read
+  - grep
+  - glob
+  - exec
+permissions:
+  allow:
+    - mcp__gitea__*
+    - Exec(make molecule *)
+    - Exec(molecule *)
+    - Exec(docker *)
+    - Exec(ls *)
+    - Exec(cat *)
+    - Exec(grep *)
+    - Exec(head *)
+    - Exec(tail *)
+---
+
+You are a molecule test runner for the grm repo.
+
+## Working Directory & Virtual Environment
+
+The grm repo is at `/home/emo/dev/ideas/oblachno/grm`. Always `cd` there first.
+
+All Python tools run inside `.venv`. `make` targets handle activation
+automatically — always use `make <target>`, never raw `pytest` or `ruff`
+commands. If `.venv` doesn't exist, run `make setup` first.
+
+## Available Scenarios (7 total)
+
+| Scenario | Purpose | Makefile target |
+|----------|---------|-----------------|
+| default | Basic runner installation | `make molecule` (included) |
+| multi-instance | 2 runners on same host | `make molecule` (included) |
+| lifecycle | stop/disable/enable/start | `make molecule` (included) |
+| template-content | Rendered template verification | `make molecule` (included) |
+| deregister | Runner cleanup | `make molecule` (included) |
+| update | Binary update | `make molecule` (included) |
+| remove | Full removal (destroys container) | CI only (not in `make molecule`) |
+
+**Platforms** (4): ubuntu-2204, ubuntu-2404, debian-12, archlinux
+Platform list defined in `devx.molecule.platforms` (single source of truth).
+
+**Note**: `make molecule` runs 6 scenarios (excludes `remove`).
+`make molecule-all` runs 6 scenarios on all 4 platforms.
+CI discovers all 7 scenarios via `devx.molecule.distribute_molecule`.
+
+## Molecule Weights (for LPT distribution)
+
+Configured in `pyproject.toml` `[tool.devx.molecule.weights]`:
+```
+multi-instance = 8, lifecycle = 6, update = 5, default = 4,
+deregister = 3, remove = 3, template-content = 2
+```
+
+## Docker Prerequisites
+
+```bash
+docker info > /dev/null 2>&1 && echo "Docker ready" || echo "Docker not available"
+```
+
+If Docker is not running, report immediately — do not attempt to start it.
+
+## Running Tests
+
+When given a scenario name or "all":
+1. Verify Docker is running
+2. Run the appropriate make target
+3. Capture full output (do not truncate)
+4. Parse results
+
+For a single scenario:
+```bash
+molecule test -s <scenario>
+```
+
+For all scenarios on one platform:
+```bash
+make molecule
+```
+
+For all scenarios on all platforms:
+```bash
+make molecule-all
+```
+
+## Known Issues
+
+- `ansible-lint` may warn about `command-instead-of-module` for `systemctl --user`
+  calls — this is expected (systemd module doesn't support user services) and
+  skipped in `.ansible-lint`
+- Molecule Docker driver may print "Event loop is closed" warnings on interrupt — harmless
+
+## Reporting
+
+Report:
+- **PASSED**: scenario name, platform, duration
+- **FAILED**: scenario name, platform, the failing Ansible task, error message, file:line
+- **SKIPPED**: if Docker was unavailable
+
+For failures, extract:
+- The Ansible task: `TASK [gitea-runner : task_name]` followed by `FAILED!`
+- The error detail: the `msg` field in the JSON output
+- The molecule verify step: look for `VERIFY` section
+- Platform-specific failures: note if only one OS failed
+
+Do NOT attempt to fix failures — report them with enough detail for the parent agent.
+
+## Feedback Reporting
+
+When you encounter a concrete issue with a tool, workflow, or process
+that would benefit from further investigation, create a Gitea issue
+in the `oblachno-oss/grm` repo.
+
+### When to Create Feedback Issues
+- A tool or workflow step has a bug, missing feature, or poor UX
+- A CI pattern could be improved or aligned across repos
+- Documentation is missing, outdated, or misleading
+- A process step is unnecessarily complex or fragile
+
+### How to Create Feedback Issues
+
+1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
+   `repo: "grm"`. Check if an open issue already covers the same topic.
+   Do NOT create duplicates.
+
+2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
+   `repo: "grm"`:
+   - **Title**: `[feedback] <category>: <short description>`
+   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
+     `doc-improvement`, `workflow-improvement`
+   - **Body** must include these sections:
+     ```
+     **Context**: What task you were performing, which repo
+     **Tool/Workflow**: The specific tool or workflow step involved
+     **Issue**: What went wrong or could be improved
+     **Reproduction**: Steps to reproduce (if applicable)
+     **Affected files**: File paths and line numbers
+     **Suggested investigation**: What an agent should look into
+     **Reported by**: <subagent profile name>
+     ```
+
+3. **Report back**: Include the issue URL in your report to the parent agent.
+
+### When NOT to Create Feedback Issues
+- Transient failures (network blips, rate limits, Docker pull flakiness)
+- Issues you can fix yourself — fix them instead
+- CI run failures — those are handled by `notify_failure` automatically
+- Missing labels — `configure_repo` creates standard labels on next master push
@@ -0,0 +1,154 @@
+---
+name: workflow-validator
+description: Validates Gitea Actions workflow YAML files for the grm repo using actionlint and act_runner dry-run. Fixes syntax errors, job dependency issues, and molecule distribution matrix problems.
+model: glm-5.2
+allowed-tools:
+  - mcp_call_tool
+  - mcp_list_tools
+  - mcp_read_resource
+  - read
+  - grep
+  - glob
+  - exec
+  - edit
+permissions:
+  allow:
+    - mcp__gitea__*
+    - Exec(make workflow-lint)
+    - Exec(make workflow-dryrun)
+    - Exec(make workflow-check)
+    - Exec(make install-tools)
+    - Exec(actionlint *)
+    - Exec(act_runner *)
+    - Exec(cat *)
+    - Exec(grep *)
+    - Exec(git diff *)
+---
+
+You are a Gitea Actions workflow validator for the grm repo.
+
+## Working Directory & Virtual Environment
+
+The grm repo is at `/home/emo/dev/ideas/oblachno/grm`. Always `cd` there first.
+
+All Python tools run inside `.venv`. `make` targets handle activation
+automatically — always use `make <target>`, never raw `pytest` or `ruff`
+commands. If `.venv` doesn't exist, run `make setup` first.
+
+## Key Files
+
+- `.gitea/workflows/ci.yml` — PR pipeline (quality, detect-changes, pre-merge-check, discover-runners, molecule-tests, molecule-report, release-dry-run, pr-review, auto-merge)
+- `.gitea/workflows/post-merge.yml` — master pipeline (detect-type, validate-commit-msg, release, publish, sync-wiki, badges, vikunja, configure-repo)
+- `.gitea/actionlint.yaml` — actionlint config (registers custom `docker` runner label)
+
+## Validation Procedure
+
+### Step 1: Install tools (if not present)
+```bash
+make install-tools  # installs actionlint, act_runner to ~/.local/bin
+```
+
+### Step 2: Static lint with actionlint
+```bash
+make workflow-lint
+```
+Fix any: syntax errors, invalid expressions, unknown keys, shellcheck issues,
+undefined variables, unknown actions, job dependency issues.
+
+### Step 3: Dry-run with act_runner
+```bash
+make workflow-dryrun
+```
+Fix any: image not found, circular dependencies, step ordering issues,
+matrix expansion problems.
+
+### Step 4: Full check
+```bash
+make workflow-check
+```
+
+## GRM-Specific Workflow Concerns
+
+**Molecule test distribution:**
+The `molecule-tests` job uses a matrix `[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]`
+with `max-parallel: 3`. Runners beyond the discovered count skip via
+`--skip-if-excess`. The `discover-runners` job queries the Gitea API
+for available runners.
+
+If the matrix is too small, some scenarios won't run. If too large,
+excess runners skip (no harm). The default 10 slots should be enough.
+
+**Path filtering:**
+Molecule tests only run when `ansible/` or `.ansible-lint` files change.
+The `detect-changes` job sets `ansible-changed` output. If this is false,
+molecule-tests is skipped — this is expected behavior.
+
+**auto-merge and always():**
+```yaml
+auto-merge:
+  needs: [quality, detect-changes, pre-merge-check, pr-review, molecule-tests]
+  if: >-
+    always() &&
+    github.event_name == 'pull_request' &&
+    needs.quality.result == 'success' &&
+    needs.pre-merge-check.result == 'success' &&
+    needs.pr-review.result == 'success' &&
+    (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
+```
+
+**Gitea Actions limitations (1.26.x):**
+- No `fromJSON()` in matrix context
+- `concurrency` blocks can cause stuck jobs
+- `GITHUB_OUTPUT` for step outputs
+
+## Report
+- **actionlint results**: pass/fail per workflow file, specific errors
+- **dry-run results**: pass/fail per workflow, job dependency issues
+- **Files changed**: if any workflow YAML was modified
+- **Verification**: re-run results after fixes
+
+Do NOT commit — report back to the parent agent.
+
+## Feedback Reporting
+
+When you encounter a concrete issue with a tool, workflow, or process
+that would benefit from further investigation, create a Gitea issue
+in the `oblachno-oss/grm` repo.
+
+### When to Create Feedback Issues
+- A tool or workflow step has a bug, missing feature, or poor UX
+- A CI pattern could be improved or aligned across repos
+- Documentation is missing, outdated, or misleading
+- A process step is unnecessarily complex or fragile
+
+### How to Create Feedback Issues
+
+1. **Deduplicate first**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "list_issues", with `labels: "feedback"`, `owner: "oblachno-oss"`,
+   `repo: "grm"`. Check if an open issue already covers the same topic.
+   Do NOT create duplicates.
+
+2. **Create the issue**: Use `mcp_call_tool` with server_name "gitea",
+   tool_name "issue_write", method "create_issue", `owner: "oblachno-oss"`,
+   `repo: "grm"`:
+   - **Title**: `[feedback] <category>: <short description>`
+   - **Labels**: `feedback` + one of: `tooling`, `ci-improvement`,
+     `doc-improvement`, `workflow-improvement`
+   - **Body** must include these sections:
+     ```
+     **Context**: What task you were performing, which repo
+     **Tool/Workflow**: The specific tool or workflow step involved
+     **Issue**: What went wrong or could be improved
+     **Reproduction**: Steps to reproduce (if applicable)
+     **Affected files**: File paths and line numbers
+     **Suggested investigation**: What an agent should look into
+     **Reported by**: <subagent profile name>
+     ```
+
+3. **Report back**: Include the issue URL in your report to the parent agent.
+
+### When NOT to Create Feedback Issues
+- Transient failures (network blips, rate limits, Docker pull flakiness)
+- Issues you can fix yourself — fix them instead
+- CI run failures — those are handled by `notify_failure` automatically
+- Missing labels — `configure_repo` creates standard labels on next master push
@@ -0,0 +1,38 @@
+# devx-workflow
+
+Quick reference for devx tools when working on this repo.
+
+## PR Workflow (use these, not raw git/tea/MCP)
+
+| Task | Command |
+|------|---------|
+| Create Vikunja task | `make create-task -- --title "..." --description "..."` |
+| Create PR | `make create-pr` |
+| Push + create PR | `make push-with-pr` |
+| Check CI status | `make devx-pr-status` or `make devx-pr-status PR=42 WAIT=1` |
+| Fetch CI failure logs | `make devx-pr-logs` or `make devx-pr-logs PR=42 JOB=quality TAIL=50` |
+| Add ready-to-merge label | `make devx-pr-label` or `make devx-pr-label PR=42` |
+| Post PR review | `make devx-pr-review PR=42 EVENT=APPROVE BODY="..." CHECKLIST=1,2,3,4,5,6,7,8,9,10,11,12,13` |
+| Rebase current branch | `make rebase` |
+| Rebase PR via API | `make pr-rebase` or `make pr-rebase PR=42` |
+
+## Auto-merge Behavior
+
+When the `ready-to-merge` label is added and all CI checks pass:
+1. Auto-merge validates PR title format (`GRM-N: <vikunja task title>`)
+2. If branch is behind master, auto-merge **rebases via Gitea API** automatically
+3. The rebase triggers a new CI run; the next auto-merge attempt merges
+4. No manual rebase needed unless the API rebase fails
+
+## Pre-merge Check
+
+CI runs a `pre-merge-check` job early (after quality + detect-changes)
+that validates branch format, PR title, and Vikunja task match.
+This fails fast before expensive molecule tests run.
+
+## Key Rules
+
+- Never manually merge via API — always use auto-merge with `ready-to-merge` label
+- Branch naming: `GRM-N-short-description` (N = Vikunja task ID)
+- Commit format: conventional commits (`feat:`, `fix:`, `docs:`, etc.)
+- PR title: `GRM-N: <vikunja task title>` (auto-derived by `make create-pr`)
@@ -0,0 +1,92 @@
+# testing-and-debugging
+
+Make targets for testing, debugging, and CI investigation. **Use these
+instead of raw `pytest`, `ruff`, or `molecule` commands.**
+
+## Why Make Targets
+
+Make targets encapsulate the correct venv activation, PYTHONPATH, env
+vars, and flags. Running raw commands bypasses venv activation and
+produces false failures (missing dependencies, wrong Python version).
+
+## Unit Tests
+
+| Task | Command | Notes |
+|------|---------|-------|
+| Run all unit tests | `make test-unit` | Fast, no coverage |
+| Run with coverage | `make pytest-cov` | **Required before push** — enforces 100% |
+| Run single test | `make pytest-cov TEST=tests/test_foo.py::test_bar` | |
+
+## Linting
+
+| Task | Command | Notes |
+|------|---------|-------|
+| Full lint | `make lint-all` | ruff + pyright + bandit + ansible-lint + checkmake + actionlint |
+| Ruff only | `make lint-ruff` | |
+| Type check | `make typecheck` | pyright |
+| Bandit | `make lint-bandit` | Security linter |
+| Workflow lint | `make workflow-check` | actionlint + act_runner dry-run |
+
+## Molecule Tests
+
+| Task | Command | Notes |
+|------|---------|-------|
+| All scenarios | `make molecule` | All 6 scenarios on Ubuntu 22.04 |
+| All platforms | `make molecule-all` | All 6 scenarios on all 4 OSes |
+| Parallel | `make molecule-all-parallel` | MOLECULE_JOBS=4 |
+
+## Pre-Push Verification
+
+**Before pushing any branch:**
+
+```bash
+make pre-push
+```
+
+This runs `lint-all` + `pytest-cov`. The pre-push git hook only
+validates the Vikunja task exists — it does NOT run tests. You must
+run `make pre-push` manually.
+
+## CI Failure Investigation
+
+When investigating a CI failure:
+
+1. **Fetch logs via MCP** — use `mcp_call_tool` with gitea server,
+   `actions_run_read` method, `download_job_log` tool
+2. **Reproduce locally** — use `make pytest-cov` or `make lint-ci`
+   depending on which CI job failed
+3. **Never run raw pytest** — always use the make target
+
+## Virtual Environment
+
+All commands run inside `.venv`. `make` targets handle activation
+automatically. For raw commands (rare), activate first:
+
+```bash
+source activate.sh       # bash/zsh
+source activate.fish     # fish
+source activate.zsh      # zsh
+```
+
+If `.venv` doesn't exist, run `make setup` first.
+
+## Common Pitfalls
+
+### Coverage Verification Before Push
+
+**Always run `make pytest-cov` before pushing** — CI enforces 100%
+coverage and will fail the PR if any lines are uncovered. This is the
+most common cause of CI quality job failures after code changes. The
+pre-push git hook only validates Vikunja task existence, not tests.
+
+### API Response Type Checking
+
+Never use `is True`/`is False` identity checks on API response values.
+Many APIs return boolean values as strings (`"true"`/`"false"`). Use
+string comparison or truthy/falsy helpers instead.
+
+### Time Mocking in Tests
+
+Always mock `time.sleep` and `time.monotonic` in unit tests using
+`@patch` decorators. Real sleep calls make tests slow and exceed test
+speed limits.
@@ -60,4 +60,4 @@ DEVX_TASK_PREFIX=GRM
 # Vikunja project ID for GRM
 DEVX_VIKUNJA_PROJECT_ID=6
 # Version file path (relative to repo root)
-DEVX_VERSION_FILE=src/gitea_runner_manager/__init__.py
+DEVX_VERSION_FILE=src/grm/__init__.py
@@ -20,36 +20,42 @@ jobs:
        env:
          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-        run: make setup-image EXTRAS=lint
+        run: make setup-image EXTRAS=ci,lint
      - name: Lint all
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
          make lint-all
      - name: Unit tests with 100% coverage
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          make pytest-cov
+      - name: Documentation lint check
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.lint_docs --root .
      - name: Translation completeness check
        run: |
-          . .venv/bin/activate
-          python3 -m devx.ci.check_translations --translations src/gitea_runner_manager/translations.json
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.check_translations --translations src/grm/translations.json
      - name: Check unit test speed
        env:
          PYTHONPATH: src
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
      - name: Dependency security scan
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          # Install pip in venv if missing (needed by pip-audit)
          .venv/bin/python -m ensurepip 2>/dev/null || true
          PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
            pip-audit --desc --skip-editable 2>&1 || true
      - name: Workflow dry-run validation
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
          # Best-effort: only runs if act_runner is installed
          if command -v act_runner >/dev/null 2>&1; then
@@ -76,10 +82,10 @@ jobs:
      - name: Release dry-run validation
        env:
          PYTHONPATH: src
-          DEVX_VERSION_FILE: src/gitea_runner_manager/__init__.py
+          DEVX_VERSION_FILE: src/grm/__init__.py
          DEVX_TASK_PREFIX: GRM
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.release --dry-run

@@ -105,12 +111,43 @@ jobs:
          PYTHONPATH: src
          DEVX_TASK_PREFIX: GRM
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.classify_changes \
            --base "origin/master" \
            --head "${{ github.event.pull_request.head.sha || github.sha }}" \
            --github-output

+  pre-merge-check:
+    needs: [quality, detect-changes]
+    if: github.event_name == 'pull_request'
+    runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        run: make setup-image EXTRAS=ci
+      - name: Validate auto-merge preconditions
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
+          DEVX_TASK_PREFIX: GRM
+          DEVX_VIKUNJA_PROJECT_ID: 6
+          HEAD_REF: ${{ github.head_ref }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.number }}
+          PYTHONPATH: ${{ env.PYTHONPATH }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.check_auto_merge_ready \
+            --branch "$HEAD_REF" \
+            --pr-title "$PR_TITLE" \
+            --repo "$REPOSITORY" \
+            --pr-number "$PR_NUMBER"
+
  discover-runners:
    needs: [detect-changes]
    if: needs.detect-changes.outputs.ansible-changed == 'true'
@@ -134,7 +171,7 @@ jobs:
          MOLECULE_RUNNERS: ${{ vars.MOLECULE_RUNNERS }}
          PYTHONPATH: src
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.molecule.discover_runners \
            --owner "${{ github.repository_owner }}" \
            --repo "${{ github.event.repository.name }}" \
@@ -147,8 +184,10 @@ jobs:
    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
    timeout-minutes: 10
    strategy:
+      fail-fast: true
+      max-parallel: 3
      matrix:
-        runner-index: [1, 2, 3]
+        runner-index: [1, 2, 3, 4, 5, 6]
    steps:
      - uses: actions/checkout@v4
      - name: Set up environment
@@ -158,7 +197,7 @@ jobs:
        run: make setup-image EXTRAS=ci,molecule
      - name: Install Ansible collections
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.tools.setup --skip-install --no-pre-commit --no-tea-login
      - name: Discover assigned test pairs
        env:
@@ -166,7 +205,7 @@ jobs:
          MAX_RUNNERS: ${{ needs.discover-runners.outputs.runner-count }}
          PYTHONPATH: src
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.molecule.distribute_molecule \
            --runner-index "$RUNNER_INDEX" \
            --max-runners "$MAX_RUNNERS" \
@@ -174,7 +213,7 @@ jobs:
      - name: Run molecule tests
        if: env.SKIP != 'true'
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          if [ -z "$TEST_PAIRS" ]; then exit 0; fi
          if ! python3 -c "import docker; docker.from_env().ping()" 2>/dev/null; then
            echo "Docker not available in CI container — skipping molecule tests"
@@ -216,7 +255,7 @@ jobs:
          PYTHONPATH: src
        run: |
          set -euo pipefail
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.pr_review \
            "${{ github.event.number }}" \
            "${{ github.repository }}"
@@ -226,11 +265,12 @@ jobs:
    # from the branch name, validates the PR title, and squash-merges.
    # Uses always() so it evaluates even when molecule-tests is skipped
    # (Gitea Actions skips dependent jobs of skipped jobs by default).
-    needs: [quality, detect-changes, pr-review, molecule-tests, release-dry-run]
+    needs: [quality, detect-changes, pre-merge-check, pr-review, molecule-tests, release-dry-run]
    if: >-
      always() &&
      github.event_name == 'pull_request' &&
      needs.quality.result == 'success' &&
+      needs.pre-merge-check.result == 'success' &&
      needs.pr-review.result == 'success' &&
      (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped') &&
      (needs.release-dry-run.result == 'success' || needs.release-dry-run.result == 'skipped')
@@ -250,6 +290,21 @@ jobs:
          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
        run: make setup-image EXTRAS=ci
+      - name: Post approval review
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
+          REPOSITORY: ${{ github.repository }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.pr_review \
+            "$PR_NUMBER" \
+            "$REPOSITORY" \
+            --event APPROVE \
+            --checklist-confirmed \
+            --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
+            --body "Auto-approved: all CI checks passed (quality, molecule, pr-review, pre-merge-check)."
      - name: Squash merge with task ID
        env:
          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
@@ -262,7 +317,7 @@ jobs:
          REPOSITORY: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.number }}
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.auto_merge \
            "$HEAD_REF" \
            "$PR_TITLE" \
@@ -56,7 +56,7 @@ jobs:
        env:
          PYTHONPATH: src
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.detect_release_commit

  validate-commit-msg:
@@ -79,7 +79,7 @@ jobs:
          PYTHONPATH: src
          DEVX_TASK_PREFIX: GRM
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          git log -1 --format=%B > commit-msg.txt
          python3 -m devx.ci.validate_commit_msg commit-msg.txt --branch master
          rm -f commit-msg.txt
@@ -110,11 +110,11 @@ jobs:
        id: release-tag
        env:
          PYTHONPATH: src
-          DEVX_VERSION_FILE: src/gitea_runner_manager/__init__.py
+          DEVX_VERSION_FILE: src/grm/__init__.py
          DEVX_TASK_PREFIX: GRM
          DEVX_VIKUNJA_PROJECT_ID: 6
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.release
      - name: Notify on failure
@@ -152,7 +152,7 @@ jobs:
          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
          PYTHONPATH: src
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.publish \
            "${{ needs.release.outputs.tag }}" \
@@ -176,7 +176,10 @@ jobs:
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
-    timeout-minutes: 10
+    timeout-minutes: 15
+    concurrency:
+      group: sync-wiki-${{ github.repository }}
+      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
        with:
@@ -191,7 +194,7 @@ jobs:
          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
          PYTHONPATH: src
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.sync_wiki --repo "${{ github.repository }}" --strict
      - name: Notify on failure
        if: failure()
@@ -231,7 +234,7 @@ jobs:
        env:
          PRE_COMMIT_ALLOW_NO_CONFIG: "1"
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.push_badges
      - name: Notify on failure
        if: failure()
@@ -268,7 +271,7 @@ jobs:
          DEVX_TASK_PREFIX: GRM
          DEVX_VIKUNJA_PROJECT_ID: 6
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.ci.post_merge --git-sha "${{ github.sha }}"
      - name: Notify on failure
        if: failure()
@@ -304,7 +307,7 @@ jobs:
          DEVX_REPO_OWNER: oblachno-oss
          DEVX_STATUS_CHECKS: "CI / quality (pull_request),CI / molecule-tests (1) (pull_request),CI / molecule-tests (2) (pull_request),CI / molecule-tests (3) (pull_request)"
        run: |
-          . .venv/bin/activate
+          . .venv/bin/activate 2>/dev/null || true
          python3 -m devx.tools.configure_repo
      - name: Notify on failure
        if: failure()
@@ -57,6 +57,37 @@ repos:
        pass_filenames: false
        stages: [pre-commit]

+      - id: checkmake
+        name: checkmake Makefile linter
+        entry: make checkmake
+        language: system
+        files: ^Makefile$
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: check-test-speed
+        name: unit test speed check
+        entry: .venv/bin/python -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
+        language: system
+        types: [python]
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: check-translations
+        name: translation completeness check
+        entry: env PYTHONPATH=src .venv/bin/python -m devx.ci.check_translations --translations src/grm/translations.json
+        language: system
+        files: ^src/grm/translations\.json$
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: lint-docs
+        name: documentation lint check
+        entry: env PYTHONPATH=src .venv/bin/python -m devx.ci.lint_docs --root .
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
      - id: pytest-cov
        name: pytest with 100% coverage
        entry: make pytest-cov
@@ -1,5 +1,19 @@
 # AGENTS.md — Project Conventions for GRM

+## Virtual Environment
+
+All Python tools, tests, and scripts run inside a standard `.venv` directory.
+Activate it before running any non-`make` command:
+
+```bash
+source activate.sh       # bash/zsh
+source activate.fish     # fish
+source activate.zsh      # zsh
+```
+
+If `.venv` doesn't exist, run `make setup` first. The `make` targets handle
+venv activation automatically — always prefer `make <target>` over raw commands.
+
 ## Build & Test Commands

 ```bash
@@ -42,7 +56,7 @@ CI also runs a best-effort `make workflow-dryrun` step (skipped if act_runner is

 ## Architecture

- **Python CLI** (`src/gitea_runner_manager/`) — Click-based CLI that delegates to Ansible
+- **Python CLI** (`src/grm/`) — Click-based CLI that delegates to Ansible
 - **Ansible Role** (`ansible/roles/gitea-runner/`) — Idempotent role for rootless Docker runner setup
 - **devx package** (installed from git) — Reusable CI/CD tools: auto-merge, post-merge, release, publishing, molecule distribution, PR reviews, failure notifications
 - **Versioning** (`cliff.toml`) — git-cliff configuration for automated semver versioning from conventional commits
@@ -163,6 +177,12 @@ Then add the `ready-to-merge` label. The auto-merge workflow will:
 5. The post-merge workflow marks the Vikunja task as done
 6. The release workflow automatically versions, tags, and publishes (see below)

+**If the branch is behind master** (another PR merged first), auto-merge
+automatically rebases the PR's head branch via the Gitea API. This triggers
+a new CI run. The next auto-merge attempt will merge successfully.
+No manual rebase needed. To rebase manually: `make rebase` (local) or
+`make pr-rebase` (server-side via API).
+
 > **IMPORTANT**: Never manually merge PRs via the API. Always use the auto-merge
 > workflow by adding the `ready-to-merge` label. Manual merges bypass the
 > `GRM-N: <conventional>` format enforcement, producing incorrectly named commits.
@@ -171,6 +191,10 @@ Then add the `ready-to-merge` label. The auto-merge workflow will:

 ### CI Path Filtering

+The CI workflow includes a `pre-merge-check` job (runs after quality +
+detect-changes) that validates branch format, PR title, and Vikunja task
+match. This fails fast before expensive molecule tests run.
+
 The CI workflow includes a `detect-changes` job that checks whether any files
 under `ansible/` or `.ansible-lint` have changed. If no Ansible files are
 changed, molecule tests are skipped — this prevents non-Ansible changes
@@ -208,7 +232,7 @@ Vikunja task updates:
     `AGENTS.md`, `Makefile`, etc.), the release is **skipped entirely** — no version
     bump, no tag, no publish. This prevents unnecessary releases for CI/docs-only changes.
   - Uses **git-cliff** to calculate the next semver version from conventional commits
-   - Updates `__version__` in `src/gitea_runner_manager/__init__.py` (single source of truth)
+   - Updates `__version__` in `src/grm/__init__.py` (single source of truth)
   - Updates `CHANGELOG.md` with the new version section
   - **Runs `make lint-ruff` and `make pytest-cov`** to verify the release is healthy
   - If lint or tests fail, **aborts immediately** — no commit, no tag
@@ -242,11 +266,11 @@ Not all changes require the full CI pipeline or a new release. The project
 classifies changes into two categories using `devx.ci.classify_changes`:

 **Classification strategy (safe-by-default):** Any file NOT in the explicit
-workflow-only allowlist is treated as user-facing. This prevents new file
+infrastructure allowlist is treated as user-facing. This prevents new file
 types from accidentally skipping releases. Classification is config-driven
 via `[tool.devx.classify]` in `pyproject.toml`.

-**Workflow-only paths** (infrastructure → no release needed):
+**Infrastructure paths** (no release needed):
 - `.gitea/**` — Gitea Actions workflows
 - `scripts/**` — Dev tools and CI/CD automation (not part of installed package)
 - `docs/**` — Documentation
@@ -260,14 +284,14 @@ via `[tool.devx.classify]` in `pyproject.toml`.
 - `activate.sh`, `activate.fish`, `activate.zsh` — Generated venv scripts

 **User-facing paths** (tool changes → release needed) — everything else:
- `src/gitea_runner_manager/**` — Python CLI source (except `__init__.py`)
+- `src/grm/**` — Python CLI source (except `__init__.py`)
 - `ansible/**` — Ansible role
 - `pyproject.toml` — Package metadata
 - Any new file type not in the allowlist

 **devx module structure** (installed from git, not in this repo):
 - `devx.ci.*` — CI/CD automation (run by workflows): release, publish, auto_merge, classify_changes, detect_release_commit, push_badges, doc_coverage, sync_wiki, distribute_molecule, molecule_ci_guard, discover_runners, notify_failure, post_merge, pr_review, validate_commit_msg
- `devx.tools.*` — Dev tools (run locally): check_test_speed, configure_repo, install_checkmake, install_tools, setup, generate_badges
+- `devx.tools.*` — Dev tools (run locally): check_test_speed, configure_repo, install_checkmake, install_tools, setup, generate_badges, create_task, create_pr, pr_status, pr_logs, pr_label, rebase, pr_rebase
 - `devx.molecule.*` — Molecule helpers: molecule_all, platforms, discover_runners, distribute_molecule, molecule_ci_guard
 - `devx.gitea_cli` — Tea CLI wrapper
 - `devx.i18n` — i18n translation system
@@ -283,7 +307,7 @@ via `[tool.devx.classify]` in `pyproject.toml`.

 **AI agents must follow these rules:**
 - When working on workflow/CI/docs-only changes, use `ci:` or `docs:` commit prefixes
- Do NOT bump the version or create tags for workflow-only changes
+- Do NOT bump the version or create tags for infrastructure-only changes
 - The `classify_changes` module enforces this automatically — no manual intervention needed

 ## Source Code Separation and devx Integration
@@ -294,14 +318,14 @@ The codebase enforces strict separation between the GRM tool and the devx packag

 | Directory | Purpose | Release impact |
 |-----------|---------|----------------|
-| `src/gitea_runner_manager/` | User-facing GRM CLI tool | Changes trigger release |
+| `src/grm/` | User-facing GRM CLI tool | Changes trigger release |
 | `devx` package (installed from git) | Reusable CI/CD and dev tools | Not in this repo (no release impact) |
 | `ansible/` | Ansible role for runner setup | Changes trigger release |

 ### Import Rules

-1. **`src/gitea_runner_manager/` NEVER imports from devx** — the GRM tool is self-contained
-2. **devx MAY import from `gitea_runner_manager`** — one-way dependency (devx uses the tool's API clients, config, i18n)
+1. **`src/grm/` NEVER imports from devx** — the GRM tool is self-contained
+2. **devx MAY import from `grm`** — one-way dependency (devx uses the tool's API clients, config, i18n)
 3. **Cross-module imports within devx** are allowed (devx modules importing from other devx modules) and must be documented
 4. **`devx.gitea_cli`** is a shared wrapper around the `tea` CLI — devx modules import from it for Gitea API operations (issues, labels, PRs, releases, reviews)

@@ -331,11 +355,11 @@ The `tea` Gitea CLI tool is used for Gitea API interactions in devx. It is insta

 ### PYTHONPATH Configuration

-Since devx is installed as a package (via `pip install` from git), it is importable directly. Workflows only need `PYTHONPATH=src` when a devx module imports from `gitea_runner_manager`:
+Since devx is installed as a package (via `pip install` from git), it is importable directly. Workflows only need `PYTHONPATH=src` when a devx module imports from `grm`:

 | PYTHONPATH | When to use | Example modules |
 |------------|-------------|-----------------|
-| `src` | Module imports from `gitea_runner_manager` | `devx.ci.auto_merge`, `devx.ci.pr_review`, `devx.ci.pr_review`, `devx.ci.sync_wiki`, `devx.ci.post_merge`, `devx.ci.classify_changes`, `devx.molecule.discover_runners`, `devx.ci.doc_coverage` |
+| `src` | Module imports from `grm` | `devx.ci.auto_merge`, `devx.ci.pr_review`, `devx.ci.pr_review`, `devx.ci.sync_wiki`, `devx.ci.post_merge`, `devx.ci.classify_changes`, `devx.molecule.discover_runners`, `devx.ci.doc_coverage` |
 | (none) | Module has no GRM imports | `devx.ci.detect_release_commit`, `devx.molecule.distribute_molecule`, `devx.molecule.molecule_ci_guard`, `devx.ci.push_badges`, `devx.ci.validate_commit_msg` |

 **In workflows**, always use `env:` blocks (not inline `PYTHONPATH=value`):
@@ -346,7 +370,7 @@ Since devx is installed as a package (via `pip install` from git), it is importa
  run: python -m devx.ci.example
 ```

-**Locally**, devx is installed as a package, so only `PYTHONPATH=src` is needed if importing from `gitea_runner_manager`.
+**Locally**, devx is installed as a package, so only `PYTHONPATH=src` is needed if importing from `grm`.

 ### Shared Constants

@@ -379,7 +403,7 @@ ensures all merged work appears in the changelog.
 | `feat!:` or `BREAKING CHANGE` | minor (pre-1.0: major would be 1.0.0) |
 | `chore:`, `ci:`, `docs:` | no bump (excluded by cliff.toml) |

-The version source is `__version__` in `src/gitea_runner_manager/__init__.py`, read by setuptools via `dynamic = ["version"]` in `pyproject.toml`. The release script only updates `__init__.py` — no need to touch `pyproject.toml`. `grm --version` reports this version.
+The version source is `__version__` in `src/grm/__init__.py`, read by setuptools via `dynamic = ["version"]` in `pyproject.toml`. The release script only updates `__init__.py` — no need to touch `pyproject.toml`. `grm --version` reports this version.

 ### Title Format Summary

@@ -395,9 +419,9 @@ The version source is `__version__` in `src/gitea_runner_manager/__init__.py`, r
 The devx package is configured via `DEVX_*` environment variables:
 - `DEVX_TASK_PREFIX=GRM` — Prefix for Vikunja task identifiers
 - `DEVX_VIKUNJA_PROJECT_ID=6` — Vikunja project ID for task tracking
- `DEVX_VERSION_FILE=src/gitea_runner_manager/__init__.py` — Path to the version source file
+- `DEVX_VERSION_FILE=src/grm/__init__.py` — Path to the version source file

-Change classification is config-driven via `[tool.devx.classify]` in `pyproject.toml`, which defines the workflow-only and user-facing path patterns.
+Change classification is config-driven via `[tool.devx.classify]` in `pyproject.toml`, which defines the infrastructure and user-facing path patterns.

 ## Key Conventions

@@ -409,6 +433,50 @@ Change classification is config-driven via `[tool.devx.classify]` in `pyproject.
 - Secrets are passed via temp JSON files, never on the command line (CWE-214)
 - CI triggers only on `opened` and `synchronize` PR events (not `labeled`)

+### Testing Conventions
+
+- **Always run `make pytest-cov` before pushing** — CI enforces 100%
+  coverage and will fail the PR if any lines are uncovered. The pre-push
+  hook only validates Vikunja task existence, not tests.
+- **Never use `is True`/`is False` identity checks on API response
+  values** — many APIs return boolean values as strings (`"true"`/
+  `"false"`). Use string comparison or truthy/falsy helpers instead.
+- **Always mock `time.sleep` and `time.monotonic` in unit tests** — real
+  sleep calls make tests slow and exceed test speed limits. Use
+  `@patch("time.sleep")` and `@patch("time.monotonic")` decorators.
+- **Extract complex inline shell from workflows to tested Python tools**
+  — SSH loops, curl polling, docker exec chains, and multi-line
+  if/then/else shell blocks should be Python scripts in `scripts/`
+  with unit tests. Simple variable checks and venv activation are fine
+  as inline shell.
+
+### Container-Level Fix Verification (Mandatory)
+
+**Rule:** Before pushing any fix that modifies container state (CA certs,
+config files, installed packages, daemon restarts), reproduce the exact
+sequence locally with the actual Docker image. Do not push to CI as the
+first test.
+
+This is a hard rule, not a suggestion. CI cycles take 20+ minutes and
+ephemeral staging VMs are destroyed after each run, making interactive
+debugging impossible. A local reproduction takes 30 seconds and catches
+silent failures immediately.
+
+**Procedure:**
+1. `docker pull <actual_image>`
+2. `docker run -d --name <test> ...` and wait for it to start
+3. Run the exact commands from the Ansible task or script
+4. Verify the state change took effect
+5. Clean up: `docker rm -f <test>`
+
+### Verified State Modification (Mandatory)
+
+Ansible tasks that modify container state with `changed_when: false`
+MUST include a post-task verification step that confirms the state
+change took effect. `changed_when: false` suppresses both change
+detection AND failure visibility — a task can silently do nothing and
+report `ok`.
+
 ## Ansible Role Structure

 ```
@@ -422,10 +490,12 @@ main.yml → systemd_check → user_setup → rootless_docker → install_runner

 ## Molecule Scenarios

-6 scenarios: `default`, `multi-instance`, `lifecycle`, `template-content`, `deregister`, `update`
+7 scenarios: `default`, `multi-instance`, `lifecycle`, `template-content`, `deregister`, `update`, `remove`
 4 platforms: `ubuntu-2204`, `ubuntu-2404`, `debian-12`, `archlinux`
 Platform list is defined in `devx.molecule.platforms` (single source of truth)

+Note: `make molecule` and `make molecule-all` run 6 scenarios (excluding `remove`, which destroys the test container). CI discovers all 7 scenarios via `devx.molecule.distribute_molecule`.
+
 ## Known Issues

 - `ansible-lint` may warn about `command-instead-of-module` for `systemctl --user` calls — this is expected (systemd module doesn't support user services) and skipped in `.ansible-lint`
@@ -475,3 +545,86 @@ docs/
 2. If adding a new page, add it to `docs/mapping.json`
 3. Commit and create a PR (standard PR workflow)
 4. On merge, wiki is automatically synced
+
+## Subagent Delegation Policy
+
+Custom subagent profiles are defined in `.devin/agents/` (project-specific)
+and `~/.config/devin/agents/` (global, shared across repos). The agent MUST
+automatically delegate to the appropriate subagent based on the task —
+the user should not need to specify which profile to use.
+
+### Available Profiles
+
+**Global** (shared with infra and devx):
+
+| Profile | Location | Purpose |
+|---------|----------|---------|
+| `pr-reviewer` | `~/.config/devin/agents/` | 13-category PR checklist + quality gates |
+| `release-check` | `~/.config/devin/agents/` | Pre-merge readiness validation |
+
+**grm-specific** (in `.devin/agents/`):
+
+| Profile | Purpose |
+|---------|---------|
+| `ci-investigator` | Investigate CI failures (quality, molecule, release, publish, wiki sync) |
+| `molecule-runner` | Run 7 molecule scenarios across 4 platforms, report pass/fail |
+| `dep-upgrader` | Python + Ansible dependency upgrades with molecule verification |
+| `doc-sync-specialist` | Doc coverage, doc linting, wiki sync for grm docs |
+| `workflow-validator` | actionlint + act_runner dry-run for grm workflows |
+
+### When to Delegate Automatically
+
+| Trigger | Profile | Mode |
+|---------|---------|------|
+| CI run failure (quality, molecule-tests, release, publish, sync-wiki) | `ci-investigator` | Background |
+| PR ready for review | `pr-reviewer` | Foreground |
+| Molecule tests need to run | `molecule-runner` | Background |
+| Dependency upgrade requested | `dep-upgrader` | Background |
+| Doc coverage failure or wiki sync issue | `doc-sync-specialist` | Background |
+| Workflow YAML modified or validation needed | `workflow-validator` | Background |
+| Branch ready for merge | `release-check` | Foreground |
+
+### Delegation Rules
+
+1. **Auto-select the profile.** Do not ask the user which profile to use.
+2. **Background by default, foreground when blocking.**
+3. **Provide full context in the prompt** — subagents don't inherit conversation history.
+4. **One subagent per concern.** Chain: investigate → fix in main session → review.
+5. **Don't delegate trivial work** (<30s, <50 lines of context).
+6. **Compact after subagent returns.**
+7. **Never skip delegation to save time** — it keeps main context small.
+
+
+## Feedback Issue Handling
+
+Subagents create Gitea issues in the current repo when they encounter
+tool, workflow, or process issues that warrant follow-up. These issues
+use the `feedback` label plus a category label (`tooling`,
+`ci-improvement`, `doc-improvement`, `workflow-improvement`).
+
+Standard labels are created automatically by `configure_repo` (runs in
+post-merge on every master push). If a label does not exist yet, the
+subagent's issue creation will still succeed — labels can be added
+afterwards.
+
+### When a Subagent Reports a Feedback Issue URL
+
+1. **Acknowledge it** in your response to the user — mention the issue URL
+2. **Do NOT close or modify** the issue — it is for follow-up work
+3. **Do NOT create a PR** to address it unless the user explicitly asks
+4. If the user asks to address feedback, spawn a subagent to investigate
+   the issue and implement a fix
+
+### Creating Feedback Issues Manually
+
+As the parent agent, you can also create feedback issues directly using
+the Gitea MCP (`issue_write` with `create_issue` method). Follow the
+same format as subagents:
+
+- Title: `[feedback] <category>: <short description>`
+- Labels: `feedback` + category label
+- Body: include context, tool/workflow, issue, reproduction, affected
+  files, suggested investigation, and "Reported by: parent agent"
+
+Always deduplicate first via `list_issues` with `labels: "feedback"`.
+
@@ -2,6 +2,68 @@

 All notable changes to this project will be documented in this file.

+## [0.14.3] - 2026-07-06
+
+### Refactor
+
+- Rename PyPI package from gitea-runner-manager to grm
+
+## [0.14.2] - 2026-07-05
+
+### Bug Fixes
+
+- Add pre-commit hooks for quality gates matching CI
+
+## [0.14.1] - 2026-07-01
+
+### Refactor
+
+- Align venv management to devx.mak targets
+
+## [0.14.0] - 2026-07-01
+
+### Features
+
+- Bump devx to v0.30.0
+
+## [0.13.0] - 2026-07-01
+
+### Features
+
+- Bump devx to v0.29.1, upgrade molecule, ubuntu 26.04
+
+## [0.12.5] - 2026-06-30
+
+### Bug Fixes
+
+- Right-size molecule-tests matrix to [1-6]
+- Cast disk threshold to string in template-content verify assertion
+
+## [0.12.4] - 2026-06-29
+
+### Bug Fixes
+
+- Use hardcoded matrix array for Gitea 1.26 compatibility
+
+## [0.12.3] - 2026-06-29
+
+### Bug Fixes
+
+- Fix wiki link URLs, heading hierarchy, quote pip install vars
+- Improve runner service stability and deregistration
+
+## [0.12.2] - 2026-06-28
+
+### Bug Fixes
+
+- Bump devx to 0.26.3 (latest with pinned deps)
+
+## [0.12.1] - 2026-06-28
+
+### Bug Fixes
+
+- Add approval step to auto-merge workflow using REVIEW_GITEA_TOKEN
+
 ## [0.12.0] - 2026-06-28

 ### Features
@@ -1,5 +1,7 @@
 # Contributing to GRM

+For the full contributing guide, see the [Contributing wiki page](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki/Contributing).
+
 Thank you for contributing to Gitea Runner Manager (GRM)!

 ## Branch Naming
@@ -1,4 +1,4 @@
-.PHONY: all setup setup-ci setup-quality setup-molecule setup-release setup-image install update lint ansible-lint makefile-lint lint-all lint-ruff lint-format lint-bandit lint-deps typecheck checkmake install-hooks test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check install-tools
+.PHONY: all setup setup-ci setup-quality setup-molecule setup-release setup-image install update lint ansible-lint makefile-lint lint-all lint-ruff lint-format lint-bandit lint-deps typecheck checkmake install-hooks test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check install-tools check-api-identity-checks
 .PHONY: configure-gitea-pypi
 .PHONY: create-task create-pr push-with-pr git-push

@@ -14,7 +14,7 @@ all: setup
 DEVX_PYTHON := $(BIN)/python
 DEVX_VENV := $(VENV)
 DEVX_BIN := $(BIN)
-DEVX_COV_PKG := src/gitea_runner_manager
+DEVX_COV_PKG := src/grm
 DEVX_TEST_PATHS := tests/ scripts/tests/
 DEVX_LINT_PATHS := src/ scripts/ tests/

@@ -25,6 +25,18 @@ DEVX_LINT_PATHS := src/ scripts/ tests/
 DEVX_MAK := $(shell $(BIN)/python -c \
 	"from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
 	2>/dev/null)
+# Fallback: when the venv doesn't exist yet, try system python3 or /opt/venv.
+# In CI, /opt/venv has devx pre-installed; locally, devx may be in system python.
+ifeq ($(strip $(DEVX_MAK)),)
+DEVX_MAK := $(shell python3 -c \
+	"from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
+	2>/dev/null)
+endif
+ifeq ($(strip $(DEVX_MAK)),)
+DEVX_MAK := $(shell /opt/venv/bin/python -c \
+	"from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
+	2>/dev/null)
+endif
 -include $(DEVX_MAK)

 # Full setup for local development (all deps, tools, collections, hooks)
@@ -77,28 +89,14 @@ setup-image:
 		pip install -e .$(if $(EXTRAS),[$(EXTRAS)],); \
 	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi

-# Helper: run pip install with Gitea registry configured
-# Usage: $(PIP_INSTALL) install -e '.[ci,lint]'
-PIP_INSTALL := if [ -z "$$CI_GITEA_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
-	CI_GITEA_TOKEN="$$CI_GITEA_TOKEN"; \
-	if [ -n "$$CI_GITEA_TOKEN" ]; then export PIP_EXTRA_INDEX_URL="https://$$CI_GITEA_USERNAME:$$CI_GITEA_TOKEN@git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple/"; fi; \
-	$(BIN)/pip
-
-$(VENV)/bin/activate:
-	@python3 -c "import sys; v=sys.version_info; assert v >= (3, 12), f'Python 3.12+ required, found {v.major}.{v.minor}'; print(f'Python {v.major}.{v.minor}.{v.micro} OK')"
-	$(PYTHON) -m venv $(VENV)
-	$(BIN)/pip install --upgrade pip setuptools wheel
-
-.env:
-	@if [ ! -f .env ]; then \
-		cp .env.example .env; \
-		echo "Created .env from .env.example — please edit it with your credentials."; \
-	fi
-
-activate-scripts: $(VENV)/bin/activate
-	@test -f activate.sh || (echo '#!/usr/bin/env bash' > activate.sh && echo 'source "$$(cd "$$(dirname "$${BASH_SOURCE[0]}")" && pwd)/.venv/bin/activate"' >> activate.sh && chmod +x activate.sh)
-	@test -f activate.fish || (echo '#!/usr/bin/env fish' > activate.fish && echo 'set -l script_dir (dirname (status --current-filename))' >> activate.fish && echo 'source "$$script_dir/.venv/bin/activate.fish"' >> activate.fish && chmod +x activate.fish)
-	@test -f activate.zsh || (echo '#!/usr/bin/env zsh' > activate.zsh && echo '0="$${ZERO:-$${0:#$$ZSH_ARGZERO}}"' >> activate.zsh && echo '0="$${$${(M)0:#/*}:-$$PWD/$$0}"' >> activate.zsh && echo 'source "$${0:A:h}/.venv/bin/activate"' >> activate.zsh && chmod +x activate.zsh)
+# venv, .env, activate-scripts, and PIP_INSTALL are provided by devx.mak
+# (devx-venv, devx-env, devx-activate-scripts, DEVX_PIP_INSTALL)
+# Aliases for convenience and backward compatibility:
+.PHONY: venv activate-scripts
+PIP_INSTALL := $(DEVX_PIP_INSTALL)
+venv: devx-venv
+.env: devx-env
+activate-scripts: devx-activate-scripts

 install:
 	@if [ -z "$(HOST)" ]; then echo "HOST is required. Example: make install HOST=192.168.1.10"; exit 1; fi
@@ -154,7 +152,7 @@ test-unit: devx-test-unit

 # Override devx-pytest-cov to cover both src/ and scripts/
 pytest-cov:
-	@$(BIN)/pytest $(DEVX_TEST_PATHS) -v --cov=src/gitea_runner_manager --cov=scripts --cov-report=term-missing --cov-fail-under=100
+	@$(BIN)/pytest $(DEVX_TEST_PATHS) -v --cov=src/grm --cov=scripts --cov-report=term-missing --cov-fail-under=100
 workflow-lint: devx-workflow-lint
 workflow-dryrun: devx-workflow-dryrun
 workflow-check: devx-workflow-check
@@ -175,7 +173,10 @@ makefile-lint:
 		echo "checkmake not found, skipping Makefile lint"; \
 	fi

-lint-all: lint ansible-lint makefile-lint workflow-lint
+lint-all: lint ansible-lint makefile-lint workflow-lint check-api-identity-checks
+
+check-api-identity-checks:
+	@$(BIN)/python -m devx.tools.check_api_identity_checks

 test-integration:
 	$(BIN)/pytest tests/integration/ -v --no-cov
@@ -8,12 +8,12 @@ Each runner runs in an isolated **rootless Docker** environment under a dedicate

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/python.svg)](https://www.python.org/downloads/)

 ## Why GRM?

@@ -99,7 +99,7 @@ The registry is publicly readable — no authentication required to install.
 **Quick install (one-off):**

 ```bash
-pip install gitea-runner-manager --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
+pip install grm --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
 ```

 **Persistent configuration (recommended):**
@@ -115,7 +115,7 @@ extra-index-url = https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/py
 Then install normally:

 ```bash
-pip install gitea-runner-manager
+pip install grm
 ```

 This installs the `grm` CLI and its Python dependencies. The Ansible playbooks
@@ -151,6 +151,7 @@ GRM provides a single `grm` command with subcommands for the full runner lifecyc
 | `grm remove <name> --force` | Remove only the local registry entry (skip remote cleanup) |
 | `grm list` | List all registered runners with live status |
 | `grm list --no-status` | List registered runners without SSH status checks |
+| `grm health [name]` | Run health check (Docker, runner service, disk) on one or all runners |
 | `grm trigger-workflow <workflow_id>` | Trigger a Gitea Actions workflow via the API |
 | `grm trigger-workflow --list` | List available workflows in the repository |
 | `grm --version` | Show the installed version |
@@ -338,7 +339,7 @@ See the [Development Setup](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/w

 GRM consists of two layers:

-1. **Python CLI** (`src/gitea_runner_manager/`) — Built with Click, handles argument parsing, environment loading, i18n translations, and delegates to Ansible via the `ansible-playbook` subprocess. Secrets are passed via temporary JSON files to avoid exposure in the process list.
+1. **Python CLI** (`src/grm/`) — Built with Click, handles argument parsing, environment loading, i18n translations, and delegates to Ansible via the `ansible-playbook` subprocess. Secrets are passed via temporary JSON files to avoid exposure in the process list.

 2. **Ansible Role** (`ansible/roles/gitea-runner/`) — Idempotent role that creates a dedicated system user, sets up rootless Docker, installs the runner binary, creates a systemd user service, registers the runner with Gitea, and sets up a Docker prune timer.

@@ -1,17 +1,3 @@
 # Troubleshooting

-| Symptom | Likely Cause | Solution |
-|---------|-------------|----------|
-| Pre-commit rejects commit message | Missing conventional format or GRM-N prefix present | Use `feat: description` format without `GRM-N:` |
-| `make molecule` fails with `runner_name is undefined` | Verify playbook missing variable | Fixed in Phase 1.1; ensure you're on latest master |
-| CI molecule job fails | Docker not available on runner host | Ensure Gitea runner host has Docker installed and running |
-| Auto-merge doesn't trigger | Label not exactly `ready-to-merge` or CI checks not all green | Verify label spelling; check CI status |
-| Vikunja task not updated after merge | VIKUNJA_TOKEN expired or task ID missing from commit | Regenerate token; verify merge commit has `GRM-N:` prefix |
-| Post-merge can't find Vikunja task | Task not in project 6 or identifier mismatch | Verify task exists in Vikunja project 6 with correct identifier |
-| `make pytest-cov` fails | Coverage below 100% | Add tests for new code paths |
-| `devx.tools.configure_repo` fails | CI_GITEA_TOKEN missing or invalid | Set token with repo admin scope and re-run |
-| `configure_repo` sets wrong status checks | Stale `BRANCH_PROTECTION_CONFIG` | Updated to include `(pull_request)` suffix; re-run `configure_repo` |
-| Token visible in `ps aux` during install | Old version passed tokens via command line | Fixed: tokens now passed via temp file with `0600` permissions |
-| `remove-runner.yml` leaves lingering enabled | Old version didn't disable lingering | Fixed: now runs `loginctl disable-linger` and removes subuid/subgid |
-| apt cache update always reports `changed` | `cache_valid_time: 0` forced update every run | Fixed: changed to `cache_valid_time: 3600` |
-| Prune/service templates created even when `docker_rootless_setup: false` | Template tasks not guarded | Fixed: template creation now guarded by `docker_rootless_setup` |
+See the [Troubleshooting guide](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki/Troubleshooting) in the wiki.
@@ -18,6 +18,16 @@
      when: systemd_available.stat.exists
      changed_when: true

+    - name: Stop and disable healthcheck timer
+      ansible.builtin.command: systemctl --user stop --disable runner-healthcheck.timer
+      become: true
+      become_user: "{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}"
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid | default('') }}"
+      when: systemd_available.stat.exists
+      changed_when: true
+      failed_when: false
+
    - name: Include deregistration
      ansible.builtin.include_role:
        name: gitea-runner
@@ -79,6 +79,16 @@
        tasks_from: deregister.yml
      when: not skip_runner_registration | default(false)

+    - name: Stop and disable healthcheck timer
+      ansible.builtin.command: systemctl --user stop --disable runner-healthcheck.timer
+      become: true
+      become_user: "{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}"
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid | default('') }}"
+      when: systemd_available.stat.exists
+      changed_when: true
+      failed_when: false
+
    - name: Remove docker-prune user service file
      ansible.builtin.file:
        path: "{{ gitea_runner_home | default('/home/grm-' ~ runner_name) }}/.config/systemd/user/docker-prune.service"
@@ -91,6 +101,24 @@
        state: absent
      failed_when: false

+    - name: Remove healthcheck user service file
+      ansible.builtin.file:
+        path: "{{ gitea_runner_home | default('/home/grm-' ~ runner_name) }}/.config/systemd/user/runner-healthcheck.service"
+        state: absent
+      failed_when: false
+
+    - name: Remove healthcheck user timer file
+      ansible.builtin.file:
+        path: "{{ gitea_runner_home | default('/home/grm-' ~ runner_name) }}/.config/systemd/user/runner-healthcheck.timer"
+        state: absent
+      failed_when: false
+
+    - name: Remove healthcheck script
+      ansible.builtin.file:
+        path: "{{ gitea_runner_config_dir | default('/etc/gitea-runner/' ~ runner_name) }}/healthcheck.sh"
+        state: absent
+      failed_when: false
+
    - name: Remove systemd user unit file
      ansible.builtin.file:
        path: "{{ gitea_runner_home | default('/home/grm-' ~ runner_name) }}/.config/systemd/user/gitea-runner.service"
@@ -1,7 +1,7 @@
 collections:
  - name: community.general
-    version: ">=13.1.0"
+    version: "==13.1.0"
  - name: ansible.posix
-    version: ">=2.2.0"
+    version: "==2.2.0"
  - name: community.docker
-    version: ">=5.2.1"
+    version: "==5.2.1"
@@ -1,6 +1,6 @@
 ---
 gitea_runner_version: "1.0.8"
-runner_labels: "docker,ubuntu-latest:docker://runner-images:ubuntu-22.04"
+runner_labels: "docker,ubuntu-latest:docker://runner-images:ubuntu-26.04"
 skip_runner_registration: false

 # Per-runner user (rootless isolation)
@@ -24,6 +24,17 @@ gitea_runner_prune_label: "gitea-runner=true"
 # Service configuration
 gitea_runner_service_restart_sec: "5"

+# Health check configuration
+gitea_runner_healthcheck_interval: "5min"
+gitea_runner_healthcheck_boot_delay: "2min"
+gitea_runner_healthcheck_disk_threshold: 85
+gitea_runner_healthcheck_script_path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
+
+# Admin token for runner deregistration via Gitea API.
+# If not set, falls back to registration_token (which likely lacks admin scope).
+# Set this to a token with admin scope to enable automatic runner cleanup on removal.
+gitea_admin_token: ""
+
 # Removal defaults
 remove_systemd_template: true
 remove_runner_user: true
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -75,3 +75,42 @@
        that:
          - timer_stat.stat.exists
        fail_msg: "Docker prune timer is missing"
+
+    - name: Check healthcheck script exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_healthcheck_script_path }}"
+      register: healthcheck_script_stat
+
+    - name: Assert healthcheck script exists
+      ansible.builtin.assert:
+        that:
+          - healthcheck_script_stat.stat.exists
+        fail_msg: "Healthcheck script is missing"
+
+    - name: Assert healthcheck script is executable
+      ansible.builtin.assert:
+        that:
+          - healthcheck_script_stat.stat.mode == "0755"
+        fail_msg: "Healthcheck script is not executable"
+
+    - name: Check healthcheck service exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.service"
+      register: healthcheck_service_stat
+
+    - name: Assert healthcheck service exists
+      ansible.builtin.assert:
+        that:
+          - healthcheck_service_stat.stat.exists
+        fail_msg: "Healthcheck systemd service is missing"
+
+    - name: Check healthcheck timer exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.timer"
+      register: healthcheck_timer_stat
+
+    - name: Assert healthcheck timer exists
+      ansible.builtin.assert:
+        that:
+          - healthcheck_timer_stat.stat.exists
+        fail_msg: "Healthcheck systemd timer is missing"
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -89,6 +89,39 @@
          - not prune_timer_stat.stat.exists
        fail_msg: "docker-prune timer unit still exists after removal"

+    - name: Check healthcheck service unit is absent
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.service"
+      register: healthcheck_service_stat
+
+    - name: Assert healthcheck service unit is absent
+      ansible.builtin.assert:
+        that:
+          - not healthcheck_service_stat.stat.exists
+        fail_msg: "runner-healthcheck service unit still exists after removal"
+
+    - name: Check healthcheck timer unit is absent
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.timer"
+      register: healthcheck_timer_stat
+
+    - name: Assert healthcheck timer unit is absent
+      ansible.builtin.assert:
+        that:
+          - not healthcheck_timer_stat.stat.exists
+        fail_msg: "runner-healthcheck timer unit still exists after removal"
+
+    - name: Check healthcheck script is absent
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
+      register: healthcheck_script_stat
+
+    - name: Assert healthcheck script is absent
+      ansible.builtin.assert:
+        that:
+          - not healthcheck_script_stat.stat.exists
+        fail_msg: "healthcheck script still exists after removal"
+
    - name: Check subuid entry is absent
      ansible.builtin.command: "grep -c '^{{ gitea_runner_service_user }}:' /etc/subuid"
      register: subuid_check
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -30,7 +30,10 @@
        that:
          - "'Type=simple' in service_template.content | b64decode"
          - "'ExecStart={{ gitea_runner_binary_path }}' in service_template.content | b64decode"
-          - "'Restart=on-failure' in service_template.content | b64decode"
+          - "'Restart=always' in service_template.content | b64decode"
+          - "'Requires=docker.service' in service_template.content | b64decode"
+          - "'PartOf=docker.service' in service_template.content | b64decode"
+          - "'StartLimitBurst=10' in service_template.content | b64decode"
          - "'DOCKER_HOST=unix:///run/user' in service_template.content | b64decode"
          - "'XDG_RUNTIME_DIR=/run/user' in service_template.content | b64decode"
        fail_msg: "User service template is missing expected directives"
@@ -59,3 +62,45 @@
          - "'OnCalendar={{ gitea_runner_prune_schedule }}' in prune_timer.content | b64decode"
          - "'Persistent=true' in prune_timer.content | b64decode"
        fail_msg: "Prune timer template is missing expected directives"
+
+    - name: Read rendered healthcheck service template
+      ansible.builtin.slurp:
+        src: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.service"
+      register: healthcheck_service
+
+    - name: Assert healthcheck service contains expected directives
+      ansible.builtin.assert:
+        that:
+          - "'Type=oneshot' in healthcheck_service.content | b64decode"
+          - "'ExecStart={{ gitea_runner_healthcheck_script_path }}' in healthcheck_service.content | b64decode"
+          - "'DOCKER_HOST=unix:///run/user/' in healthcheck_service.content | b64decode"
+          - "'XDG_RUNTIME_DIR=/run/user/' in healthcheck_service.content | b64decode"
+        fail_msg: "Healthcheck service template is missing expected directives"
+
+    - name: Read rendered healthcheck timer template
+      ansible.builtin.slurp:
+        src: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.timer"
+      register: healthcheck_timer
+
+    - name: Assert healthcheck timer contains expected directives
+      ansible.builtin.assert:
+        that:
+          - "'OnBootSec={{ gitea_runner_healthcheck_boot_delay }}' in healthcheck_timer.content | b64decode"
+          - "'OnUnitActiveSec={{ gitea_runner_healthcheck_interval }}' in healthcheck_timer.content | b64decode"
+          - "'Persistent=true' in healthcheck_timer.content | b64decode"
+        fail_msg: "Healthcheck timer template is missing expected directives"
+
+    - name: Read rendered healthcheck script
+      ansible.builtin.slurp:
+        src: "{{ gitea_runner_healthcheck_script_path }}"
+      register: healthcheck_script
+
+    - name: Assert healthcheck script contains expected content
+      ansible.builtin.assert:
+        that:
+          - "'docker info' in healthcheck_script.content | b64decode"
+          - "'systemctl --user restart docker.service' in healthcheck_script.content | b64decode"
+          - "'systemctl --user restart gitea-runner.service' in healthcheck_script.content | b64decode"
+          - "'docker system prune' in healthcheck_script.content | b64decode"
+          - "gitea_runner_healthcheck_disk_threshold | string in healthcheck_script.content | b64decode"
+        fail_msg: "Healthcheck script template is missing expected content"
@@ -4,7 +4,7 @@ driver:

 platforms:
  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
+    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:26.04}
    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
@@ -18,13 +18,11 @@
      else {} }}
  when: runner_file_stat.stat.exists | default(false) | bool

- name: Deregister runner with Gitea via CLI
+- name: Deregister runner from Gitea via API
  ansible.builtin.command: >
-    {{ gitea_runner_binary_path }} delete
-    --token {{ registration_token }}
-    --name {{ runner_name }}
-    --instance {{ gitea_url }}
-    --no-interactive
+    curl -sf --connect-timeout 5 --max-time 10 -X DELETE
+    -H "Authorization: token {{ gitea_admin_token | default(registration_token) }}"
+    "{{ gitea_url }}/api/v1/admin/actions/runners/{{ runner_reg.id }}"
  args:
    chdir: "{{ gitea_runner_data_dir }}"
  become: true
@@ -35,10 +33,24 @@
  when:
    - runner_file_stat.stat.exists | default(false) | bool
    - not skip_runner_registration
+    - runner_reg.id is defined
  register: deregister_output
  changed_when: deregister_output.rc == 0
  failed_when: false

+- name: Warn if deregistration failed
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: Runner deregistration from Gitea failed (rc={{ deregister_output.rc | default('N/A') }}).
+      The runner entry may remain in Gitea's admin UI as offline.
+      Use an admin token (gitea_admin_token var) to enable automatic cleanup,
+      or remove it manually from {{ gitea_url }}/-/admin/actions/runners
+  when:
+    - runner_file_stat.stat.exists | default(false) | bool
+    - not skip_runner_registration
+    - deregister_output is defined
+    - deregister_output.rc | default(1) != 0
+
 - name: Remove runner registration file
  ansible.builtin.file:
    path: "{{ gitea_runner_data_dir }}/.runner"
@@ -0,0 +1,46 @@
+---
+- name: Create healthcheck script
+  ansible.builtin.template:
+    src: runner-healthcheck.sh.j2
+    dest: "{{ gitea_runner_healthcheck_script_path }}"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+    mode: "0755"
+
+- name: Create healthcheck user service file
+  ansible.builtin.template:
+    src: runner-healthcheck.service.j2
+    dest: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.service"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+    mode: "0644"
+
+- name: Create healthcheck user timer file
+  ansible.builtin.template:
+    src: runner-healthcheck.timer.j2
+    dest: "{{ gitea_runner_home }}/.config/systemd/user/runner-healthcheck.timer"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+    mode: "0644"
+
+- name: Reload systemd user daemon for healthcheck timer
+  ansible.builtin.command: systemctl --user daemon-reload
+  become: true
+  become_user: "{{ gitea_runner_service_user }}"
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+  changed_when: true
+  when:
+    - systemd_available.stat.exists
+    - docker_rootless_setup
+
+- name: Enable and start healthcheck user timer
+  ansible.builtin.command: systemctl --user enable --now runner-healthcheck.timer
+  become: true
+  become_user: "{{ gitea_runner_service_user }}"
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+  changed_when: true
+  when:
+    - systemd_available.stat.exists
+    - docker_rootless_setup
@@ -14,6 +14,9 @@
 - name: Include prune setup
  ansible.builtin.include_tasks: prune.yml

+- name: Include healthcheck setup
+  ansible.builtin.include_tasks: healthcheck.yml
+
 - name: Include integration test
  ansible.builtin.include_tasks: integration_test.yml
  when: not skip_runner_registration
@@ -6,4 +6,4 @@ Type=oneshot
 Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
 Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
 ExecStart=/usr/bin/docker system prune -f --filter "label={{ gitea_runner_prune_label }}" --filter "until={{ gitea_runner_prune_until }}"
-ExecStart=/usr/bin/docker volume prune -f --filter "label={{ gitea_runner_prune_label }}" --filter "until={{ gitea_runner_prune_until }}"
+ExecStart=/usr/bin/docker volume prune -f --filter "label={{ gitea_runner_prune_label }}"
@@ -1,6 +1,8 @@
 [Unit]
 Description=Gitea Actions Runner (rootless)
 After=docker.service
+Requires=docker.service
+PartOf=docker.service

 [Service]
 Type=simple
@@ -10,8 +12,10 @@ Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
 Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
 ExecStop=/bin/kill -TERM $MAINPID
 TimeoutStopSec=30
-Restart=on-failure
+Restart=always
 RestartSec={{ gitea_runner_service_restart_sec }}
+StartLimitIntervalSec=300
+StartLimitBurst=10

 [Install]
 WantedBy=default.target
@@ -0,0 +1,9 @@
+[Unit]
+Description=Gitea Runner health check (Docker + service + disk)
+After=docker.service gitea-runner.service
+
+[Service]
+Type=oneshot
+Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
+Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+ExecStart={{ gitea_runner_healthcheck_script_path }}
@@ -0,0 +1,49 @@
+#!/bin/bash
+# Health check for gitea-runner: verifies Docker daemon and runner service.
+# Exits 0 if healthy, 1 if Docker is down (triggers restart), 2 if runner is down.
+set -euo pipefail
+
+DOCKER_HOST="unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
+XDG_RUNTIME_DIR="/run/user/{{ gitea_runner_uid }}"
+export DOCKER_HOST XDG_RUNTIME_DIR
+
+# 1. Check Docker daemon responsiveness
+if ! docker info >/dev/null 2>&1; then
+    echo "ERROR: Docker daemon not responding at ${DOCKER_HOST}"
+    systemctl --user restart docker.service
+    sleep 3
+    if ! docker info >/dev/null 2>&1; then
+        echo "CRITICAL: Docker daemon still down after restart"
+        exit 1
+    fi
+    echo "RECOVERED: Docker daemon restarted successfully"
+fi
+
+# 2. Check gitea-runner service is active
+runner_state=$(systemctl --user is-active gitea-runner.service 2>/dev/null || true)
+if [[ "$runner_state" != "active" ]]; then
+    echo "ERROR: gitea-runner service is ${runner_state}, restarting"
+    systemctl --user restart gitea-runner.service
+    sleep 2
+    runner_state=$(systemctl --user is-active gitea-runner.service 2>/dev/null || true)
+    if [[ "$runner_state" != "active" ]]; then
+        echo "CRITICAL: gitea-runner service still down after restart"
+        exit 2
+    fi
+    echo "RECOVERED: gitea-runner service restarted successfully"
+fi
+
+# 3. Check disk space — prune aggressively if below threshold
+disk_pct=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
+if [[ "$disk_pct" -ge {{ gitea_runner_healthcheck_disk_threshold }} ]]; then
+    echo "WARN: Disk usage at ${disk_pct}%, pruning all runner resources"
+    docker system prune -af --filter "label={{ gitea_runner_prune_label }}" --filter "until=1h" || true
+    docker volume prune -af --filter "label={{ gitea_runner_prune_label }}" || true
+    # Also prune dangling images (no label)
+    docker image prune -af || true
+    disk_pct=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
+    echo "INFO: Disk usage after prune: ${disk_pct}%"
+fi
+
+echo "OK: runner healthy, disk at ${disk_pct}%"
+exit 0
@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodic Gitea Runner health check
+
+[Timer]
+OnBootSec={{ gitea_runner_healthcheck_boot_delay }}
+OnUnitActiveSec={{ gitea_runner_healthcheck_interval }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -8,12 +8,12 @@ Each runner runs in an isolated **rootless Docker** environment under a dedicate

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/dfe10dfc2483ccdda434e9b067348921257fdffd/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/08460d0769c8abe19fe57c7dec4e097463392e32/python.svg)](https://www.python.org/downloads/)

 ## Overview

@@ -42,20 +42,20 @@ All supported OSes are tested in CI via Molecule scenarios on every PR that chan

 ## User Documentation

- [Getting Started](Getting-Started.-) — Installation, quick start, token setup, first run, log viewing
+- [Getting Started](Getting-Started) — Installation, quick start, token setup, first run, log viewing
 - [Installation](Installation) — Prerequisites, setup methods, multiple instances, runner registry
- [CLI Commands](CLI-Commands.-) — All commands with arguments, options, and examples
+- [CLI Commands](CLI-Commands) — All commands with arguments, options, and examples
 - [Troubleshooting](Troubleshooting) — Common issues, diagnostics, and solutions
 - [FAQ](FAQ) — Frequently asked questions

 ## Technical Documentation

 - [Architecture](Architecture) — High-level design, component diagram, data flow, security model, per-runner isolation
- [Development Setup](Development-Setup.-) — Environment setup, project structure, dependencies, linting, testing
- [CI/CD Workflow](CI-CD-Workflow.-) — PR workflow, branch protection, release pipeline, change classification, badge generation
- [Testing Strategy](Testing-Strategy.-) — Unit tests, Molecule scenarios, integration tests, CI distribution
- [Decision Log](Decision-Log.-) — Key technical decisions and rationale (ADRs)
- [Contributing Guide](Contributing-Guide.-) — Coding standards, PR workflow, commit conventions, Ansible role conventions
+- [Development Setup](Development-Setup) — Environment setup, project structure, dependencies, linting, testing
+- [CI/CD Workflow](CI-CD-Workflow) — PR workflow, branch protection, release pipeline, change classification, badge generation
+- [Testing Strategy](Testing-Strategy) — Unit tests, Molecule scenarios, integration tests, CI distribution
+- [Decision Log](Decision-Log) — Key technical decisions and rationale (ADRs)
+- [Contributing Guide](Contributing-Guide) — Coding standards, PR workflow, commit conventions, Ansible role conventions

 ## Quick Links

@@ -2,7 +2,7 @@

 GRM consists of two layers:

-1. **Python CLI** (`src/gitea_runner_manager/`) — built with Click, handles argument parsing, environment loading, i18n translations, and delegates to Ansible via the `ansible-playbook` subprocess.
+1. **Python CLI** (`src/grm/`) — built with Click, handles argument parsing, environment loading, i18n translations, and delegates to Ansible via the `ansible-playbook` subprocess.
 2. **Ansible Role** (`ansible/roles/gitea-runner/`) — idempotent role that creates a dedicated system user, sets up rootless Docker, installs the runner binary, creates a systemd user service, and registers the runner with Gitea.

 ## High-Level Design
@@ -31,13 +31,14 @@ grm install <host>
              ├── rootless_docker.yml  (rootless Docker setup under runner user)
              ├── install_runner.yml   (download binary, config, register, service)
              ├── prune.yml            (Docker prune timer)
+              ├── healthcheck.yml      (health check script + systemd timer)
              └── integration_test.yml (validate service is active)
 ```

 The Ansible role task execution order (from `AGENTS.md`):

 ```
-main.yml → systemd_check → user_setup → rootless_docker → install_runner → prune → integration_test
+main.yml → systemd_check → user_setup → rootless_docker → install_runner → prune → healthcheck → integration_test
 ```

 - `install_runner.yml` handles: download, config, validate, register, service
@@ -59,6 +60,7 @@ main.yml → systemd_check → user_setup → rootless_docker → install_runner
 | `register.yml` | Registers the runner with Gitea using the registration token |
 | `service.yml` | Creates the systemd user service file and starts/enables the service |
 | `prune.yml` | Creates a systemd user timer for daily Docker image and volume pruning |
+| `healthcheck.yml` | Installs a health check script and systemd timer that monitors Docker daemon, runner service, and disk space; restarts unhealthy services automatically |
 | `integration_test.yml` | Verifies the `.runner` file exists and the systemd service is active; optionally queries the Gitea API |
 | `deregister.yml` | Deregisters the runner from Gitea and removes the `.runner` file |
 | `update_runner.yml` | Downloads a new version of the gitea_runner binary |
@@ -71,6 +73,9 @@ main.yml → systemd_check → user_setup → rootless_docker → install_runner
 | `gitea-runner-config.yaml.j2` | Runner configuration file (labels, capacity, log level) |
 | `docker-prune.service.j2` | Systemd user service for Docker pruning (oneshot) |
 | `docker-prune.timer.j2` | Systemd user timer triggering daily Docker prune |
+| `runner-healthcheck.sh.j2` | Health check script (checks Docker, runner service, disk space; restarts if down) |
+| `runner-healthcheck.service.j2` | Systemd user service for the health check (oneshot) |
+| `runner-healthcheck.timer.j2` | Systemd user timer triggering periodic health checks |

 ## Per-Runner Isolation

@@ -90,7 +95,7 @@ Lingering is enabled via `loginctl enable-linger` so the user's systemd services

 ```mermaid
 flowchart TD
-    CLI["Python CLI<br/>src/gitea_runner_manager/<br/>(Click)"]
+    CLI["Python CLI<br/>src/grm/<br/>(Click)"]
    RM["RunnerManager<br/>runner_manager.py"]
    EXEC["Executor<br/>executor.py"]
    REG["Registry<br/>registry.py<br/>~/.local/share/grm/runners.json"]
@@ -139,6 +144,7 @@ flowchart TD
   - Registers the runner with Gitea
   - Creates and starts the systemd user service
   - Sets up the Docker prune timer
+   - Installs the health check script and systemd timer
   - Runs the integration test (verifies `.runner` file and service state)
 7. Ansible output is streamed to a timestamped log file at `~/.local/state/grm/logs/ansible-<timestamp>.log`
 8. On success, the runner is added to the local registry at `~/.local/share/grm/runners.json`
@@ -201,7 +207,7 @@ From `AGENTS.md`, the project also includes:

 ## Python Modules

-The Python CLI layer (`src/gitea_runner_manager/`) consists of the following modules:
+The Python CLI layer (`src/grm/`) consists of the following modules:

 | Module | Description |
 |--------|-------------|
@@ -158,7 +158,7 @@ After a PR is merged to master, the release pipeline runs automatically.
 - Runs `devx.ci.release` which uses **git-cliff** to:
  - **Checks for user-facing changes** via `devx.ci.classify_changes` — if only workflow/infrastructure files changed, the release is **skipped entirely** — no version bump, no tag, no publish
  - Calculate the next semver version from conventional commits since the last tag
-  - Update `__version__` in `src/gitea_runner_manager/__init__.py` (single source of truth)
+  - Update `__version__` in `src/grm/__init__.py` (single source of truth)
  - Update `CHANGELOG.md` with the new version section
  - **Run `make lint-ruff` and `make pytest-cov`** to verify the release is healthy
  - If lint or tests fail, **abort immediately** — no commit, no tag
@@ -208,7 +208,7 @@ from accidentally skipping releases. Classification is config-driven via
 `[tool.devx.classify]` in `pyproject.toml`.

 **User-facing paths** (tool changes → release needed):
- `src/gitea_runner_manager/**` — Python CLI source
+- `src/grm/**` — Python CLI source
 - `ansible/**` — Ansible role
 - `pyproject.toml` — Package metadata

@@ -322,7 +322,7 @@ From `cliff.toml` `[bump]` section:
 - `breaking_always_bump_major = false`
 - `initial_tag = "0.1.0"`

-The version source is `__version__` in `src/gitea_runner_manager/__init__.py`, read by setuptools via `dynamic = ["version"]` in `pyproject.toml`. The release script only updates `__init__.py` — no need to touch `pyproject.toml`. `grm --version` reports this version.
+The version source is `__version__` in `src/grm/__init__.py`, read by setuptools via `dynamic = ["version"]` in `pyproject.toml`. The release script only updates `__init__.py` — no need to touch `pyproject.toml`. `grm --version` reports this version.

 ## Title Format Summary

@@ -27,9 +27,9 @@
 - **Secrets handling**: Secrets are passed via temp JSON files with `0600` permissions, never on the command line (CWE-214). Extra-vars are written to a temporary JSON file and passed via `--extra-vars @tempfile`, which is deleted after execution. This prevents secrets from being visible in the process list (`ps aux`).
 - **Linting**: `make lint-all` runs ruff + pyright + bandit + ansible-lint + checkmake + actionlint
 - **Formatting**: `ruff format` with double quotes and space indentation
- **Type checking**: `pyright` in strict mode for `src/gitea_runner_manager/`
+- **Type checking**: `pyright` in strict mode for `src/grm/`
 - **Security scanning**: `bandit -r src/` on every PR
- **Import rules**: `src/gitea_runner_manager/` NEVER imports from devx — the GRM tool is self-contained
+- **Import rules**: `src/grm/` NEVER imports from devx — the GRM tool is self-contained

 ## Commit Rules

@@ -216,7 +216,7 @@ Not all changes require a new release. The project classifies changes using `dev
 - Lint config files, `.env.example`, `.gitignore`

 **User-facing paths** (release needed):
- `src/gitea_runner_manager/**` (except `__init__.py`)
+- `src/grm/**` (except `__init__.py`)
 - `ansible/**`
 - `pyproject.toml`

@@ -8,7 +8,7 @@ Key technical decisions for the GRM project, extracted from `CHANGELOG.md` and `

 **Date:** 2026-06-21 (v0.2.0 unreleased)

-**Decision:** Use `dynamic = ["version"]` in `pyproject.toml` with setuptools `attr` to source the version from `__version__` in `src/gitea_runner_manager/__init__.py`.
+**Decision:** Use `dynamic = ["version"]` in `pyproject.toml` with setuptools `attr` to source the version from `__version__` in `src/grm/__init__.py`.

 **Rationale:** `__init__.py` is the single source of truth for the version. The release script (`devx.ci.release`) only updates `__init__.py` — there is no need to touch `pyproject.toml`. `grm --version` reports this version directly. This eliminates version duplication across files and ensures the runtime version always matches the tagged release.

@@ -84,7 +84,7 @@ Key technical decisions for the GRM project, extracted from `CHANGELOG.md` and `

 **Rationale:** Passing secrets as command-line arguments (e.g., `--extra-vars '{"token": "..."}'`) makes them visible in the process list (`ps aux`), which is a known security weakness (CWE-214). The `RunnerManager._extra_vars_file()` context manager writes extra-vars to a temporary file via `tempfile.mkstemp()`, sets permissions to `0600`, passes the file to Ansible via `--extra-vars @tempfile`, and deletes the file in a `finally` block — even if an exception occurs. This ensures secrets are never visible in the process list.

-**Source:** `AGENTS.md` (Key Conventions), `src/gitea_runner_manager/runner_manager.py` (`_extra_vars_file` method)
+**Source:** `AGENTS.md` (Key Conventions), `src/grm/runner_manager.py` (`_extra_vars_file` method)

 ---

@@ -94,7 +94,7 @@ Key technical decisions for the GRM project, extracted from `CHANGELOG.md` and `

 **Decision:** Classify changed files into user-facing and workflow-only categories using `devx.ci.classify_changes`. Only user-facing changes trigger a release; workflow-only changes (CI, docs, tests, lint config) do not.

-**Rationale:** Not all changes require a new release. CI workflow updates, documentation improvements, and test additions should not produce a new version tag. The classification is config-driven via `[tool.devx.classify]` in `pyproject.toml`. The strategy is safe-by-default: any file NOT in the explicit workflow-only allowlist is treated as user-facing, preventing new file types from accidentally skipping releases. User-facing paths include `src/gitea_runner_manager/**` (except `__init__.py`) and `ansible/**`. Workflow-only paths include `.gitea/**`, `docs/**`, `tests/**`, `scripts/**`, and various config files.
+**Rationale:** Not all changes require a new release. CI workflow updates, documentation improvements, and test additions should not produce a new version tag. The classification is config-driven via `[tool.devx.classify]` in `pyproject.toml`. The strategy is safe-by-default: any file NOT in the explicit workflow-only allowlist is treated as user-facing, preventing new file types from accidentally skipping releases. User-facing paths include `src/grm/**` (except `__init__.py`) and `ansible/**`. Workflow-only paths include `.gitea/**`, `docs/**`, `tests/**`, `scripts/**`, and various config files.

 **Source:** `AGENTS.md` (Smart CI: User-Facing vs Workflow-Only Changes), `pyproject.toml` (`[tool.devx.classify]`)

@@ -104,9 +104,9 @@ Key technical decisions for the GRM project, extracted from `CHANGELOG.md` and `

 **Date:** 2026-06-21 (v0.6.2)

-**Decision:** Separate CI/CD and development tooling into the `devx` package (installed from git), keeping the GRM tool itself self-contained in `src/gitea_runner_manager/`.
+**Decision:** Separate CI/CD and development tooling into the `devx` package (installed from git), keeping the GRM tool itself self-contained in `src/grm/`.

-**Rationale:** The GRM CLI tool must be self-contained — it never imports from devx. This ensures the installed package has no dependency on CI infrastructure. devx MAY import from `gitea_runner_manager` (one-way dependency), as it uses the tool's API clients, config, and i18n for CI automation. Cross-module imports within devx are allowed. This separation was formalised when scripts were migrated from the `scripts/` directory to the devx package in GRM-64.
+**Rationale:** The GRM CLI tool must be self-contained — it never imports from devx. This ensures the installed package has no dependency on CI infrastructure. devx MAY import from `grm` (one-way dependency), as it uses the tool's API clients, config, and i18n for CI automation. Cross-module imports within devx are allowed. This separation was formalised when scripts were migrated from the `scripts/` directory to the devx package in GRM-64.

 **Source:** `AGENTS.md` (Source Code Separation and devx Integration), `CHANGELOG.md` (0.6.2 — Refactor: "Migrate from scripts/ to devx package")

@@ -4,7 +4,7 @@

 ```
 .
-├── src/gitea_runner_manager/      # Python CLI source
+├── src/grm/      # Python CLI source
 │   ├── cli.py                     # Click commands
 │   ├── runner_manager.py          # Ansible orchestration + registry integration
 │   ├── executor.py                # Ansible subprocess execution
@@ -172,7 +172,7 @@ make test-unit      # Without coverage
 make pytest-cov     # With 100% coverage enforcement
 ```

-The coverage requirement is `--cov-fail-under=100` — 100% test coverage is required for all code in `src/gitea_runner_manager/`.
+The coverage requirement is `--cov-fail-under=100` — 100% test coverage is required for all code in `src/grm/`.

 ### Integration tests

@@ -14,9 +14,9 @@ Runs pytest with 100% coverage requirement.
 From the `Makefile`:

 - `test-unit` — `pytest tests/unit/ -v --no-cov` (unit tests without coverage)
- `pytest-cov` — `pytest tests/ -v --cov=src/gitea_runner_manager --cov-report=term-missing --cov-fail-under=100` (unit tests with 100% coverage enforcement)
+- `pytest-cov` — `pytest tests/ -v --cov=src/grm --cov-report=term-missing --cov-fail-under=100` (unit tests with 100% coverage enforcement)

-The coverage requirement is `--cov-fail-under=100` — 100% test coverage is required for all code in `src/gitea_runner_manager/`. The CI quality job runs `make pytest-cov` on every PR, and the release workflow runs it again before tagging a release.
+The coverage requirement is `--cov-fail-under=100` — 100% test coverage is required for all code in `src/grm/`. The CI quality job runs `make pytest-cov` on every PR, and the release workflow runs it again before tagging a release.

 ### Test speed verification

@@ -83,7 +83,7 @@ The platform list is defined in `devx.molecule.platforms` (single source of trut

 ### CI Test Distribution

-CI runs all 6 scenarios x 4 platforms (24 test pairs) distributed across available Gitea Actions runners.
+CI runs all 7 scenarios x 4 platforms (28 test pairs) distributed across available Gitea Actions runners.

 The `discover-runners` job runs `devx.molecule.discover_runners` which queries the Gitea API for registered runners at three levels (repo, org, instance) and generates a dynamic matrix. If the API query fails (e.g., no admin access for instance-level runners), it falls back to the `MOLECULE_RUNNERS` repo variable, then to a default of 3.

@@ -10,11 +10,14 @@ GRM provides the following CLI commands for managing Gitea Actions runners. The
 | `grm update` | `<host>` | Update the gitea_runner binary on a remote host |
 | `grm start` | `<runner_name>` | Start a registered runner |
 | `grm stop` | `<runner_name>` | Stop a registered runner |
+| `grm restart` | `<runner_name>` | Restart a runner (stop, prune Docker images, start) |
 | `grm enable` | `<runner_name>` | Enable a runner to start on boot |
 | `grm disable` | `<runner_name>` | Disable and deregister a runner |
 | `grm status` | `<runner_name>` | Check the status of a registered runner |
 | `grm remove` | `<runner_name>` | Remove a runner completely |
 | `grm list` | — | List all registered runners with live status |
+| `grm health` | `[runner_name]` | Run health check (Docker, runner service, disk) on one or all runners |
+| `grm trigger-workflow` | `<workflow_id>` | Trigger a Gitea Actions workflow via the API |
 | `grm --version` | — | Show the installed version |

 ### Common lifecycle options
@@ -139,6 +142,29 @@ grm stop <runner_name> [options]
 | `--key` | `-k` | Override SSH key from registry |
 | `--ask-become-pass/--no-ask-become-pass` | — | Prompt for sudo password (default) or skip it |

+## restart
+
+Restart a registered Gitea Runner (stop, prune Docker images, start).
+
+```bash
+grm restart <runner_name> [options]
+```
+
+**Arguments:**
+
+| Argument | Description |
+|----------|-------------|
+| `runner_name` | Name of the registered runner |
+
+**Options (common lifecycle options):**
+
+| Option | Short | Description |
+|--------|-------|-------------|
+| `--host` | — | Override host from registry |
+| `--user` | `-u` | Override user from registry |
+| `--key` | `-k` | Override SSH key from registry |
+| `--ask-become-pass/--no-ask-become-pass` | — | Prompt for sudo password (default) or skip it |
+
 ## enable

 Enable a registered Gitea Runner to start on boot.
@@ -276,6 +302,70 @@ If no runners are registered:
 No runners registered. Use 'grm install' to add one.
 ```

+## health
+
+Run a health check on one or all registered runners. Checks Docker daemon status, Gitea runner service status, and disk space usage. Unhealthy services are automatically restarted by the healthcheck script.
+
+```bash
+grm health [runner_name] [options]
+```
+
+**Arguments:**
+
+| Argument | Description |
+|----------|-------------|
+| `runner_name` | (optional) Name of the runner to check. If omitted, checks all registered runners. |
+
+**Options (common lifecycle options):**
+
+| Option | Short | Description |
+|--------|-------|-------------|
+| `--host` | — | Override host from registry |
+| `--user` | `-u` | Override user from registry |
+| `--key` | `-k` | Override SSH key from registry |
+| `--ask-become-pass/--no-ask-become-pass` | — | Prompt for sudo password (default) or skip it |
+
+**Example:**
+
+```bash
+grm health
+# Check a specific runner:
+grm health prod-runner
+```
+
+Output shows NAME, HOST, HEALTHY (yes/no), and MESSAGE columns. The command exits with code 1 if any runner is unhealthy.
+
+The health check is also run automatically via a systemd timer installed by the Ansible role. See `ansible/roles/gitea-runner/templates/runner-healthcheck.sh.j2` for the script and `runner-healthcheck.timer.j2` for the timer.
+
+## trigger-workflow
+
+Trigger a Gitea Actions workflow via the API.
+
+```bash
+grm trigger-workflow <workflow_id> [options]
+grm trigger-workflow --list
+```
+
+**Arguments:**
+
+| Argument | Description |
+|----------|-------------|
+| `workflow_id` | Workflow filename (e.g., `ci.yml`) or ID |
+
+**Options:**
+
+| Option | Description |
+|--------|-------------|
+| `--list` | List available workflows in the repository |
+| `--ref` | Branch or tag to trigger on (default: repository default branch) |
+
+**Example:**
+
+```bash
+grm trigger-workflow --list
+grm trigger-workflow ci.yml --ref master
+```
+
 ## --version

 Show the installed GRM version.
@@ -284,7 +374,7 @@ Show the installed GRM version.
 grm --version
 ```

-This reports the version from `__version__` in `src/gitea_runner_manager/__init__.py`, which is the single source of truth set by the automated release pipeline.
+This reports the version from `__version__` in `src/grm/__init__.py`, which is the single source of truth set by the automated release pipeline.

 ## Environment Variables

@@ -299,5 +389,5 @@ All CLI options can be set via environment variables (loaded from `.env` via pyt
 | `GITEA_RUNNER_USER` | `install`, `update` | Default SSH user |
 | `GITEA_RUNNER_KEY` | `install`, `update` | Default SSH key path |
 | `GITEA_RUNNER_LABELS` | `install` | Default runner labels |
-| `GRM_LANG` | all | UI language: `en`, `bg`, `de`, `ru`, `zh` |
+| `GRM_LANG` | all | UI language: `en`, `bg`, `de`, `ru`, `zh`, `pl` |
 | `GRM_LOG_LEVEL` | all | Console log level: `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL` |
@@ -1,6 +1,6 @@
 # FAQ

-### How do I obtain the Gitea registration token?
+## How do I obtain the Gitea registration token?

 There are three levels of registration tokens, depending on which repositories the runner should serve:

@@ -10,7 +10,7 @@ There are three levels of registration tokens, depending on which repositories t

 Set the token as `GITEA_REGISTRATION_TOKEN` in your `.env` file or pass it via `--token` on the command line.

-### What is the CI_GITEA_TOKEN and do I need it?
+## What is the CI_GITEA_TOKEN and do I need it?

 `CI_GITEA_TOKEN` is a Gitea admin API token used for optional post-install verification. When set, GRM queries the Gitea API after installation to confirm the runner appears in the runner list. This is purely informational — the integration test passes/fails based on the `.runner` file and systemd service, not the API check.

@@ -18,7 +18,7 @@ To generate one: Settings → Applications → Generate New Token, with the `adm

 If you skip it, GRM will still verify the runner correctly — it just won't show the extra API confirmation.

-### How do I skip the sudo password prompt for automation?
+## How do I skip the sudo password prompt for automation?

 Configure passwordless sudo on the remote host and pass `--no-ask-become-pass` to the CLI command. This is recommended for CI/CD pipelines.

@@ -34,7 +34,7 @@ Then use:
 grm install 192.168.1.10 --user ubuntu --key ~/.ssh/id_ed25519 --name prod-runner --no-ask-become-pass
 ```

-### Can I run multiple runners on the same host?
+## Can I run multiple runners on the same host?

 Yes. Each runner instance is fully isolated with its own system user (`grm-<name>`), rootless Docker daemon, data directory, and systemd user service. Install additional runners with different `--name` values and manage them independently by name.

@@ -46,7 +46,7 @@ grm list

 Runners on the same host never interfere with each other or with the host's Docker installation.

-### Why does my runner appear offline after installation?
+## Why does my runner appear offline after installation?

 Check that `GITEA_URL` and `GITEA_REGISTRATION_TOKEN` are correct, verify the runner service is running with `sudo -u grm-<name> systemctl --user status gitea-runner`, and check the logs for registration errors. You can also confirm the runner appears as **Online** in the Gitea UI under **Actions → Runners**.

@@ -56,15 +56,15 @@ Common causes:
 - Rootless Docker daemon not running — check `sudo -u grm-<name> systemctl --user status docker`
 - Lingering not enabled — check `loginctl show-user grm-<name> | grep Linger`

-### What does the "Event loop is closed" warning mean?
+## What does the "Event loop is closed" warning mean?

 This is a harmless cleanup traceback from Molecule's Docker driver when the test process is interrupted. It does not indicate a test failure.

-### Where are runner connection details stored?
+## Where are runner connection details stored?

 GRM stores each runner's connection details (host, user, SSH key, Gitea URL, labels) in a local JSON registry at `~/.local/share/grm/runners.json`. After installation, lifecycle commands work by runner name only — you can override any stored value by passing the corresponding flag.

-### How do I update the gitea_runner binary?
+## How do I update the gitea_runner binary?

 Use the `grm update` command:

@@ -80,7 +80,7 @@ grm update 192.168.1.10 --user ubuntu --version 1.0.8

 The update command downloads the new binary and replaces the existing one at `/usr/local/bin/gitea_runner`. The runner service is restarted automatically.

-### How do I completely remove a runner?
+## How do I completely remove a runner?

 Use the `grm remove` command:

@@ -96,18 +96,18 @@ If the remote host is already gone or unreachable, use `--force` to skip remote
 grm remove prod-runner --force
 ```

-### What is the difference between disable and remove?
+## What is the difference between disable and remove?

 - **`grm disable <name>`** — Deregisters the runner from Gitea and stops the service, but leaves the user, directories, and service files in place. The runner can be re-enabled later with `grm enable` and re-registered with a new token.
 - **`grm remove <name>`** — Completely removes the runner: deregisters from Gitea, stops and disables the service, removes the system user, deletes all directories, and removes the local registry entry. This is irreversible.

-### What operating systems are supported?
+## What operating systems are supported?

 GRM supports Arch Linux (rolling), Ubuntu 22.04/24.04, and Debian 12. All supported OSes are tested in CI via Molecule scenarios on every PR that changes Ansible files.

-### How do I change the UI language?
+## How do I change the UI language?

-Set the `GRM_LANG` environment variable to one of the supported languages: `en` (English, default), `bg` (Bulgarian), `de` (German), `ru` (Russian), `zh` (Chinese).
+Set the `GRM_LANG` environment variable to one of the supported languages: `en` (English, default), `bg` (Bulgarian), `de` (German), `ru` (Russian), `zh` (Chinese), `pl` (Polish).

 ```bash
 GRM_LANG=bg grm install 192.168.1.10 --user ubuntu --name prod-runner
@@ -119,7 +119,7 @@ Or set it in your `.env` file:
 GRM_LANG=bg
 ```

-### How do I enable debug logging?
+## How do I enable debug logging?

 Set the `GRM_LOG_LEVEL` environment variable to `DEBUG`:

@@ -129,7 +129,7 @@ GRM_LOG_LEVEL=DEBUG grm install 192.168.1.10 --user ubuntu --name prod-runner

 The log file at `~/.local/state/grm/logs/grm.log` always captures DEBUG level regardless of this setting. Ansible execution logs are stored in timestamped files at `~/.local/state/grm/logs/ansible-<timestamp>.log`.

-### What runner labels should I use?
+## What runner labels should I use?

 By default, runners are registered with `docker,ubuntu-latest:docker://runner-images:ubuntu-22.04`. You can override this with `--labels` or the `GITEA_RUNNER_LABELS` environment variable.

@@ -142,7 +142,7 @@ grm install 192.168.1.10 --user ubuntu --name prod-runner \
  --labels "docker:docker://gitea/runner-images:ubuntu-latest"
 ```

-### Is GRM secure?
+## Is GRM secure?

 Yes. GRM is designed with security as a first-class concern:

@@ -151,17 +151,17 @@ Yes. GRM is designed with security as a first-class concern:
 - **No shell injection**: The CLI never uses `shell=True` with subprocess.
 - **Bandit security scan**: The CI pipeline runs Bandit on every PR.

-### Can I install GRM via pip?
+## Can I install GRM via pip?

 Yes:

 ```bash
-pip install gitea-runner-manager
+pip install grm
 ```

 This installs the `grm` CLI and its Python dependencies. The Ansible playbooks and role are bundled with the package. For development or access to Make targets, clone the repository instead.

-### How does GRM handle idempotence?
+## How does GRM handle idempotence?

 The Ansible role is idempotent — running `grm install` twice produces zero changes on the second run. Each task checks for existing state before making changes. For example:

@@ -98,7 +98,7 @@ CI_GITEA_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 | `GITEA_RUNNER_USER` | No | current login | Default SSH user (overrides `--user`) |
 | `GITEA_RUNNER_KEY` | No | — | Default SSH key path (overrides `--key`) |
 | `GITEA_RUNNER_LABELS` | No | — | Default runner labels (overrides `--labels`) |
-| `GRM_LANG` | No | `en` | UI language: `en`, `bg`, `de`, `ru`, `zh` |
+| `GRM_LANG` | No | `en` | UI language: `en`, `bg`, `de`, `ru`, `zh`, `pl` |
 | `GRM_LOG_LEVEL` | No | `INFO` | Console log level: `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL` |

 ## Step 3: Install Your First Runner
@@ -182,7 +182,7 @@ grm disable prod-runner    # Disable and deregister the runner
 grm remove prod-runner     # Remove the runner completely
 ```

-See [CLI Commands](CLI-Commands.-) for the full command reference.
+See [CLI Commands](CLI-Commands) for the full command reference.

 ## View Logs

@@ -232,6 +232,6 @@ Console output is automatically colorised via `click.style`: operation headers i
 ## Next Steps

 - **Install more runners** on the same or different hosts — see [Installation](Installation)
- **Learn all CLI commands** — see [CLI Commands](CLI-Commands.-)
+- **Learn all CLI commands** — see [CLI Commands](CLI-Commands)
 - **Troubleshoot issues** — see [Troubleshooting](Troubleshooting)
 - **Understand the architecture** — see [Architecture](Architecture)
@@ -1,6 +1,6 @@
 # Installation

-> **Before you start:** Make sure you have cloned the repo and checked out the latest stable release tag. See [Getting Started](Getting-Started.-) for setup instructions. Do not run from `master` — it may contain unreleased changes.
+> **Before you start:** Make sure you have cloned the repo and checked out the latest stable release tag. See [Getting Started](Getting-Started) for setup instructions. Do not run from `master` — it may contain unreleased changes.

 ## Prerequisites

@@ -14,7 +14,7 @@

 - **SSH server** — The remote host must be reachable via SSH using the user specified with `--user` and the private key specified with `--key`. GRM uses Ansible under the hood, which connects to the target host over SSH to execute all installation and configuration tasks. Without valid SSH credentials, Ansible cannot establish a connection and the deployment will fail.
 - **Sudo access** — GRM requires root privileges on the remote host to create system users, install packages, and configure rootless Docker. By default, you will be prompted interactively for the sudo password. For automation or uninterrupted workflows, configure passwordless sudo on the remote host and pass `--no-ask-become-pass`.
- **Gitea registration token** — You need a runner registration token from your Gitea instance. See [Getting Started](Getting-Started.-) for detailed instructions on obtaining tokens.
+- **Gitea registration token** — You need a runner registration token from your Gitea instance. See [Getting Started](Getting-Started) for detailed instructions on obtaining tokens.
 - **systemd** — Required for user services and lingering. All supported OSes ship with systemd.
 - **Docker** — Installed automatically by the Ansible role (rootless mode). No pre-existing Docker installation is required.

@@ -58,7 +58,7 @@ The registry is publicly readable — no authentication required to install.
 **Quick install (one-off):**

 ```bash
-pip install gitea-runner-manager --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
+pip install grm --index-url https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple
 ```

 **Persistent configuration (recommended):**
@@ -73,7 +73,7 @@ extra-index-url = https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/py
 Then install normally:

 ```bash
-pip install gitea-runner-manager
+pip install grm
 ```

 This installs the `grm` CLI and its Python dependencies. The Ansible playbooks
@@ -96,7 +96,7 @@ Required variables:
 | `GITEA_URL` | Your Gitea instance URL (e.g., `https://git.example.com`) |
 | `GITEA_REGISTRATION_TOKEN` | Runner registration token from Gitea (starts with `GR`) |

-See [Getting Started](Getting-Started.-) for detailed token setup instructions.
+See [Getting Started](Getting-Started) for detailed token setup instructions.

 ## Quick Start Install

@@ -36,7 +36,7 @@ elif [ -x "${HOME}/.pyenv/bin/pyenv" ]; then
    export PATH="${PYENV_ROOT}/bin:${PYENV_ROOT}/shims:${PATH}"
    eval "$("${PYENV_ROOT}/bin/pyenv" init -)" 2>/dev/null || true
    eval "$("${PYENV_ROOT}/bin/pyenv" virtualenv-init -)" 2>/dev/null || true
-    pyenv activate gitea-runner-manager 2>/dev/null || true
+    pyenv activate grm 2>/dev/null || true
    PY=python3
 else
    PY=python3
@@ -3,7 +3,7 @@ requires = ["setuptools>=61.0", "wheel"]
 build-backend = "setuptools.build_meta"

 [project]
-name = "gitea-runner-manager"
+name = "grm"
 dynamic = ["version"]
 description = "Lean CLI to manage Gitea Actions runners"
 readme = "README.md"
@@ -14,47 +14,47 @@ classifiers = [
    "License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
 ]
 dependencies = [
-    "python-dotenv>=1.2.2",
-    "click>=8.4.2",
-    "ansible>=14.1.0",
+    "python-dotenv==1.2.2",
+    "click==8.4.2",
+    "ansible==14.1.0",
 ]

 [project.scripts]
-grm = "gitea_runner_manager.cli:cli"
+grm = "grm.cli:cli"

 [tool.setuptools.dynamic]
-version = {attr = "gitea_runner_manager.__version__"}
+version = {attr = "grm.__version__"}

 [project.optional-dependencies]
 # Minimal deps for CI scripts that only need click/dotenv
 # (detect-changes, discover-runners, pr-review, sync-wiki, badges, etc.)
 ci = [
-    "pytest>=9.1.1",
-    "pytest-cov>=7.1.0",
-    "build>=1.5.0",
-    "twine>=6.2.0",
+    "pytest==9.1.1",
+    "pytest-cov==7.1.0",
+    "build==1.5.0",
+    "twine==6.2.0",
    # Reusable CI/CD and dev tools (auto-merge, pr-review, pre-push checks, etc.)
-    "devx>=0.26.0",
+    "devx==0.33.3",
 ]
 # Lint and type-checking tools (quality job)
 lint = [
-    "ruff>=0.15.20",
-    "pyright>=1.1.411",
-    "bandit>=1.9.4",
-    "pip-audit>=2.10.1",
-    "pre-commit>=4.6.0",
-    "ansible-lint>=26.4.0",
+    "ruff==0.15.20",
+    "pyright==1.1.411",
+    "bandit==1.9.4",
+    "pip-audit==2.10.1",
+    "pre-commit==4.6.0",
+    "ansible-lint==26.4.0",
 ]
 # Molecule testing (molecule-tests job)
 molecule = [
-    "molecule>=26.4.0",
-    "molecule-docker>=2.1.0",
+    "molecule==26.6.0",
+    "molecule-docker==2.1.0",
 ]
 # Full dev environment (local development, includes everything)
 dev = [
-    "gitea-runner-manager[ci,lint,molecule]",
+    "grm[ci,lint,molecule]",
    # Reusable CI/CD and dev tools (pre-push hooks, create-task, create-pr)
-    "devx>=0.26.0",
+    "devx==0.33.3",
    # Non-Python dev dependency: checkmake (Makefile linter)
    # Install via: go install github.com/checkmake/checkmake/cmd/checkmake@latest
 ]
@@ -63,12 +63,12 @@ dev = [
 where = ["src"]

 [tool.setuptools.package-data]
-gitea_runner_manager = ["translations.json"]
+grm = ["translations.json"]

 [tool.pytest.ini_options]
 testpaths = ["tests", "scripts/tests"]
 pythonpath = ["src", "scripts"]
-addopts = "--cov=src/gitea_runner_manager --cov=scripts/prune_runner_images.py --cov-report=term-missing --cov-fail-under=100"
+addopts = "--cov=src/grm --cov=scripts/prune_runner_images.py --cov-report=term-missing --cov-fail-under=100"
 markers = [
    "integration: marks tests as integration tests (not counted in coverage)",
 ]
@@ -88,7 +88,7 @@ indent-style = "space"
 [tool.pyright]
 include = ["src"]
 pythonVersion = "3.12"
-strict = ["src/gitea_runner_manager"]
+strict = ["src/grm"]

 # ---------------------------------------------------------------------------
 # Change classification — determines which changes trigger a release
@@ -128,7 +128,7 @@ infrastructure = ["scripts/**"]
 # but are actually infrastructure:
 # - __init__.py: only contains __version__ (set by release.py, not user code)
 infrastructure_overrides = [
-    "src/gitea_runner_manager/__init__.py",
+    "src/grm/__init__.py",
 ]

 # User-facing overrides — safety override for broad infrastructure patterns
@@ -1,3 +1,3 @@
 """Gitea Runner Manager — lean CLI for managing Gitea Actions runners."""

-__version__ = "0.12.0"
+__version__ = "0.14.3"
@@ -442,6 +442,44 @@ def _collect_become_pass(ask_become_pass: bool) -> str | None:
    return sys.stdin.readline().strip() or None


+@cli.command(name="health", help=_("Run health check on one or all registered runners."))
+@click.argument("runner_name", required=False)
+@_runner_options
+@_handle_errors("Health check failed: {error}")
+def health(
+    runner_name: str | None,
+    host: str | None,
+    user: str | None,
+    key: str | None,
+    ask_become_pass: bool,
+) -> None:
+    """Check Docker, runner service, and disk health on remote hosts."""
+    become_pass = _collect_become_pass(ask_become_pass)
+    manager = RunnerManager()
+    results = manager.health(
+        name=runner_name,
+        host=host,
+        user=user,
+        key=key,
+        ask_become_pass=ask_become_pass,
+        become_pass=become_pass,
+        become_password_file=_get_become_password_file(),
+        verbose=_get_verbose(),
+    )
+    if not results:
+        click.echo(_("No runners registered. Use 'grm install' to add one."))
+        return
+    click.echo(f"{_('NAME'):<18} {_('HOST'):<16} {_('HEALTHY'):<10} {_('MESSAGE')}")
+    click.echo("-" * 80)
+    all_healthy = True
+    for r in results:
+        if r["healthy"] != "yes":
+            all_healthy = False
+        click.echo(f"{r['name']:<18} {r['host']:<16} {r['healthy']:<10} {r['message']}")
+    if not all_healthy:
+        raise click.ClickException(_("One or more runners are unhealthy"))
+
+
@cli.command(name="list", help=_("List all registered runners with live status."))
@click.option(
    "--ask-become-pass/--no-ask-become-pass",
@@ -487,6 +487,68 @@ class RunnerManager:
            )
        return result

+    def health(
+        self,
+        name: str | None = None,
+        host: str | None = None,
+        user: str | None = None,
+        key: str | None = None,
+        ask_become_pass: bool = False,
+        become_pass: str | None = None,
+        become_password_file: str | None = None,
+        verbose: bool = False,
+    ) -> list[dict[str, str]]:
+        """Run health check on one or all registered runners.
+
+        When *name* is provided, checks only that runner. Otherwise,
+        checks all registered runners. Returns a list of dicts with
+        ``name``, ``host``, ``healthy`` (``"yes"``/``"no"``), and
+        ``message`` keys.
+        """
+        if name:
+            actual_host, actual_user, actual_key, _gitea_url = self._resolve_runner(name, host, user, key)
+            entries = [(name, actual_host, actual_user, actual_key)]
+        else:
+            entries = [(n, info["host"], info["user"], info.get("key")) for n, info in self._registry.list().items()]
+
+        results: list[dict[str, str]] = []
+        for runner_name, r_host, r_user, r_key in entries:
+            say(_("Checking health of {name} on {host}", name=runner_name, host=r_host))
+            healthy = "no"
+            message = "unknown"
+            try:
+                stdout = self._executor.run_ad_hoc(
+                    r_host,
+                    r_user,
+                    r_key,
+                    "shell",
+                    f"sudo -u grm-{runner_name} "
+                    f"XDG_RUNTIME_DIR=/run/user/$(id -u grm-{runner_name}) "
+                    f"systemctl --user start runner-healthcheck.service && "
+                    f"journalctl --user -u runner-healthcheck.service --no-pager -n 1",
+                    become=True,
+                    ask_become_pass=ask_become_pass or become_password_file is not None,
+                    check=False,
+                    become_pass=become_pass,
+                )
+                if "OK:" in stdout:
+                    healthy = "yes"
+                    # Extract the OK line
+                    for line in stdout.splitlines():
+                        if "OK:" in line:
+                            message = line.split("OK:", 1)[1].strip()
+                            break
+                else:
+                    for line in stdout.splitlines():
+                        stripped = line.strip()
+                        if stripped and "CHANGED" not in stripped and "WARNING" not in stripped:
+                            message = stripped
+                            break
+            except AnsibleError as e:
+                message = str(e)
+            results.append({"name": runner_name, "host": r_host, "healthy": healthy, "message": message})
+        return results
+
    @staticmethod
    def _parse_status(stdout: str) -> str:
        ansible_noise = (" | CHANGED | ", " | FAILED | ", " | UNREACHABLE | ", "[WARNING]", "ssh:", ">>")
@@ -31,6 +31,14 @@
    "ru": "Проверить состояние зарегистрированного Gitea Runner.",
    "zh": "检查已注册的 Gitea Runner 状态。"
  },
+  "Checking health of {name} on {host}": {
+    "bg": "Проверка на здравословното състояние на {name} на {host}",
+    "de": "Gesundheitsprüfung von {name} auf {host}",
+    "en": "Checking health of {name} on {host}",
+    "pl": "Sprawdzanie zdrowia {name} na {host}",
+    "ru": "Проверка здоровья {name} на {host}",
+    "zh": "正在检查 {host} 上 {name} 的健康状态"
+  },
  "Checking status of Gitea Runner {name} on {host}": {
    "bg": "Проверка на състоянието на Gitea Runner {name} на {host}",
    "de": "Prüfe Status von Gitea Runner {name} auf {host}",
@@ -175,6 +183,22 @@
    "ru": "Токен админ API Gitea для интеграционного теста (env: CI_GITEA_TOKEN)",
    "zh": "Gitea 管理员 API 令牌，用于集成测试（环境变量: CI_GITEA_TOKEN）"
  },
+  "HEALTHY": {
+    "bg": "ЗДРАВ",
+    "de": "GESUND",
+    "en": "HEALTHY",
+    "pl": "ZDROWY",
+    "ru": "ЗДОРОВ",
+    "zh": "健康"
+  },
+  "Health check failed: {error}": {
+    "bg": "Проверката на здравословното състояние неуспешна: {error}",
+    "de": "Gesundheitsprüfung fehlgeschlagen: {error}",
+    "en": "Health check failed: {error}",
+    "pl": "Sprawdzanie zdrowia nie powiodło się: {error}",
+    "ru": "Проверка здоровья не удалась: {error}",
+    "zh": "健康检查失败: {error}"
+  },
  "HOST": {
    "bg": "ХОСТ",
    "de": "HOST",
@@ -239,6 +263,14 @@
    "ru": "Ошибка списка: {error}",
    "zh": "列表失败: {error}"
  },
+  "MESSAGE": {
+    "bg": "СЪОБЩЕНИЕ",
+    "de": "MELDUNG",
+    "en": "MESSAGE",
+    "pl": "WIADOMOŚĆ",
+    "ru": "СООБЩЕНИЕ",
+    "zh": "消息"
+  },
  "NAME": {
    "bg": "ИМЕ",
    "de": "NAME",
@@ -263,6 +295,14 @@
    "ru": "Нет зарегистрированных runners. Используйте 'grm install' чтобы добавить.",
    "zh": "没有已注册的 runners。使用 'grm install' 添加一个。"
  },
+  "One or more runners are unhealthy": {
+    "bg": "Един или повече runners са нездравословни",
+    "de": "Ein oder mehrere Runner sind fehlerhaft",
+    "en": "One or more runners are unhealthy",
+    "pl": "Jeden lub więcej runnerów jest w złym stanie",
+    "ru": "Один или несколько runners нездоровы",
+    "zh": "一个或多个 runners 不健康"
+  },
  "Override SSH key from registry": {
    "bg": "Замяна на SSH ключа от регистъра",
    "de": "SSH-Schlüssel aus Registrierung überschreiben",
@@ -423,6 +463,14 @@
    "ru": "Выполнение Ansible playbook",
    "zh": "正在运行 Ansible playbook"
  },
+  "Run health check on one or all registered runners.": {
+    "bg": "Проверка на здравословното състояние на един или всички регистрирани runners.",
+    "de": "Gesundheitsprüfung für einen oder alle registrierten Runner ausführen.",
+    "en": "Run health check on one or all registered runners.",
+    "pl": "Uruchom sprawdzanie zdrowia jednego lub wszystkich zarejestrowanych runnerów.",
+    "ru": "Проверить здоровье одного или всех зарегистрированных runners.",
+    "zh": "对一个或所有已注册 runners 运行健康检查。"
+  },
  "SSH user (env: GITEA_RUNNER_USER)": {
    "bg": "SSH потребител (env: GITEA_RUNNER_USER)",
    "de": "SSH-Benutzer (env: GITEA_RUNNER_USER)",
@@ -5,14 +5,14 @@ from unittest.mock import MagicMock, patch
 import pytest
 from click.testing import CliRunner

-from gitea_runner_manager.cli import cli
+from grm.cli import cli


@pytest.mark.integration
 class TestLifecycleCLI:
    """Test the full lifecycle CLI commands end-to-end."""

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_start_status_stop_disable_remove(self, mock_manager_class: MagicMock) -> None:
        """Exercise the full lifecycle via CLI."""
        mock_manager = MagicMock()
@@ -5,14 +5,14 @@ from unittest.mock import MagicMock, patch
 import pytest
 from click.testing import CliRunner

-from gitea_runner_manager.cli import cli
+from grm.cli import cli


@pytest.mark.integration
 class TestMultiInstanceCLI:
    """Test that multiple runner instances can be managed independently."""

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_two_instances(self, mock_manager_class: MagicMock) -> None:
        """Install two named instances on the same host."""
        mock_manager = MagicMock()
@@ -34,7 +34,7 @@ class TestMultiInstanceCLI:
        assert calls[0].kwargs["name"] == "runner-a"
        assert calls[1].kwargs["name"] == "runner-b"

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_start_stop_one_instance(self, mock_manager_class: MagicMock) -> None:
        """Start one instance and stop another independently."""
        mock_manager = MagicMock()
@@ -6,8 +6,8 @@ from unittest.mock import MagicMock, patch
 import pytest
 from click.testing import CliRunner

-from gitea_runner_manager import __version__
-from gitea_runner_manager.cli import cli
+from grm import __version__
+from grm.cli import cli

 _TEST_ENV = {"GITEA_URL": "https://git.example.com", "CI_GITEA_TOKEN": ""}

@@ -27,7 +27,7 @@ class TestCLI:
        assert result.exit_code == 0
        assert __version__ in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -50,7 +50,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_no_ask_become_pass(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -73,10 +73,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_missing_url(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.install.side_effect = AnsibleError("GITEA_URL must be set (or pass --url)")
        mock_manager_class.return_value = mock_manager
@@ -87,7 +87,7 @@ class TestCLI:
            assert result.exit_code != 0
            assert "GITEA_URL must be set" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_with_url_flag(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -114,10 +114,10 @@ class TestCLI:
                verbose=False,
            )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_missing_token(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.install.side_effect = AnsibleError("GITEA_REGISTRATION_TOKEN must be set (or pass --token)")
        mock_manager_class.return_value = mock_manager
@@ -128,7 +128,7 @@ class TestCLI:
            assert result.exit_code != 0
            assert "GITEA_REGISTRATION_TOKEN must be set" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_with_options(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -165,7 +165,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_ask_become_pass(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -188,10 +188,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.install.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -201,7 +201,7 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_with_labels(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -226,7 +226,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_with_empty_labels(self, mock_manager_class: MagicMock) -> None:
        """Explicit empty string labels means 'no labels' (not 'use default')."""
        mock_manager = MagicMock()
@@ -250,7 +250,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_labels_from_env(self, mock_manager_class: MagicMock) -> None:
        """Labels read from GITEA_RUNNER_LABELS env var when --labels not passed."""
        mock_manager = MagicMock()
@@ -274,7 +274,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_with_become_password_file(self, mock_manager_class: MagicMock) -> None:
        """--become-password-file passes file path to manager."""
        import tempfile
@@ -311,7 +311,7 @@ class TestCLI:

            os.unlink(pw_file)

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_install_verbose(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -334,7 +334,7 @@ class TestCLI:
            verbose=True,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_update(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -364,7 +364,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_update_ask_become_pass(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -382,10 +382,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_update_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.update.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -395,7 +395,7 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_start(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -413,7 +413,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_start_with_override(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -431,7 +431,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_stop(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -449,7 +449,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_restart(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -467,7 +467,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_enable(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -485,7 +485,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_disable(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -505,10 +505,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_disable_missing_url(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.disable.side_effect = AnsibleError("GITEA_URL must be set (or pass --url)")
        mock_manager_class.return_value = mock_manager
@@ -519,7 +519,7 @@ class TestCLI:
        assert result.exit_code != 0
        assert "GITEA_URL must be set" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_disable_with_url_flag(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -540,10 +540,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_disable_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.disable.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -553,7 +553,7 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_status(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -571,7 +571,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_remove(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -592,7 +592,7 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_remove_force_flag(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -613,10 +613,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_start_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.start.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -626,10 +626,10 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_stop_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.stop.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -639,10 +639,10 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_enable_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.enable.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -652,10 +652,10 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_status_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.status.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -665,10 +665,10 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_remove_missing_url(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.remove.side_effect = AnsibleError("GITEA_URL must be set (or pass --url)")
        mock_manager_class.return_value = mock_manager
@@ -679,7 +679,7 @@ class TestCLI:
        assert result.exit_code != 0
        assert "GITEA_URL must be set" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_remove_with_url_flag(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager_class.return_value = mock_manager
@@ -701,10 +701,10 @@ class TestCLI:
            verbose=False,
        )

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_remove_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.remove.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -714,7 +714,7 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager.list_runners.return_value = [
@@ -736,7 +736,7 @@ class TestCLI:
        assert "active" in result.output
        mock_manager.list_runners.assert_called_once_with(become_pass=None, no_status=False)

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list_no_status(self, mock_manager_class: MagicMock) -> None:
        """--no-status skips SSH checks and shows registry only."""
        mock_manager = MagicMock()
@@ -758,22 +758,22 @@ class TestCLI:
        assert "n/a" in result.output
        mock_manager.list_runners.assert_called_once_with(become_pass=None, no_status=True)

-    @patch("gitea_runner_manager.cli.click.prompt", return_value="secret")
-    @patch("gitea_runner_manager.cli.sys.stdin")
+    @patch("grm.cli.click.prompt", return_value="secret")
+    @patch("grm.cli.sys.stdin")
    def test_collect_become_pass_tty(self, mock_stdin: MagicMock, mock_prompt: MagicMock) -> None:
-        from gitea_runner_manager.cli import _collect_become_pass
+        from grm.cli import _collect_become_pass

        mock_stdin.isatty.return_value = True
        assert _collect_become_pass(ask_become_pass=True) == "secret"

-    @patch("gitea_runner_manager.cli.sys.stdin")
+    @patch("grm.cli.sys.stdin")
    def test_collect_become_pass_no_ask(self, mock_stdin: MagicMock) -> None:
-        from gitea_runner_manager.cli import _collect_become_pass
+        from grm.cli import _collect_become_pass

        mock_stdin.isatty.return_value = True
        assert _collect_become_pass(ask_become_pass=False) is None

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list_with_piped_become_pass(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager.list_runners.return_value = []
@@ -784,7 +784,7 @@ class TestCLI:
        assert result.exit_code == 0
        mock_manager.list_runners.assert_called_once_with(become_pass="secret", no_status=False)

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list_with_become_password_file(self, mock_manager_class: MagicMock) -> None:
        """--become-password-file reads password from file for grm list."""
        import os
@@ -806,7 +806,7 @@ class TestCLI:
        finally:
            os.unlink(pw_file)

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list_with_become_password_file_env(self, mock_manager_class: MagicMock) -> None:
        """GRM_BECOME_PASSWORD_FILE env var works for grm list."""
        import os
@@ -828,7 +828,7 @@ class TestCLI:
        finally:
            os.unlink(pw_file)

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list_empty(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
        mock_manager.list_runners.return_value = []
@@ -839,10 +839,10 @@ class TestCLI:
        assert result.exit_code == 0
        assert "No runners registered" in result.output

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_list_error(self, mock_manager_class: MagicMock) -> None:
        mock_manager = MagicMock()
-        from gitea_runner_manager.exceptions import AnsibleError
+        from grm.exceptions import AnsibleError

        mock_manager.list_runners.side_effect = AnsibleError("fail")
        mock_manager_class.return_value = mock_manager
@@ -852,8 +852,77 @@ class TestCLI:
        assert result.exit_code != 0
        assert "fail" in result.output

-    @patch("gitea_runner_manager.cli.os.getlogin", side_effect=OSError("no tty"))
-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
+    def test_health_all_healthy(self, mock_manager_class: MagicMock) -> None:
+        mock_manager = MagicMock()
+        mock_manager.health.return_value = [
+            {"name": "r1", "host": "10.0.0.1", "healthy": "yes", "message": "runner healthy, disk at 42%"},
+            {"name": "r2", "host": "10.0.0.2", "healthy": "yes", "message": "runner healthy, disk at 50%"},
+        ]
+        mock_manager_class.return_value = mock_manager
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["health"], input="secret\n")
+        assert result.exit_code == 0
+        assert "r1" in result.output
+        assert "r2" in result.output
+        assert "yes" in result.output
+
+    @patch("grm.cli.RunnerManager")
+    def test_health_with_unhealthy(self, mock_manager_class: MagicMock) -> None:
+        mock_manager = MagicMock()
+        mock_manager.health.return_value = [
+            {"name": "r1", "host": "10.0.0.1", "healthy": "yes", "message": "runner healthy, disk at 42%"},
+            {"name": "r2", "host": "10.0.0.2", "healthy": "no", "message": "Docker daemon down"},
+        ]
+        mock_manager_class.return_value = mock_manager
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["health"], input="secret\n")
+        assert result.exit_code != 0
+        assert "unhealthy" in result.output.lower()
+        assert "r2" in result.output
+
+    @patch("grm.cli.RunnerManager")
+    def test_health_single_runner(self, mock_manager_class: MagicMock) -> None:
+        mock_manager = MagicMock()
+        mock_manager.health.return_value = [
+            {"name": "r1", "host": "10.0.0.1", "healthy": "yes", "message": "runner healthy, disk at 42%"},
+        ]
+        mock_manager_class.return_value = mock_manager
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["health", "r1"], input="secret\n")
+        assert result.exit_code == 0
+        assert "r1" in result.output
+        mock_manager.health.assert_called_once()
+
+    @patch("grm.cli.RunnerManager")
+    def test_health_empty(self, mock_manager_class: MagicMock) -> None:
+        mock_manager = MagicMock()
+        mock_manager.health.return_value = []
+        mock_manager_class.return_value = mock_manager
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["health"], input="secret\n")
+        assert result.exit_code == 0
+        assert "No runners registered" in result.output
+
+    @patch("grm.cli.RunnerManager")
+    def test_health_error(self, mock_manager_class: MagicMock) -> None:
+        mock_manager = MagicMock()
+        from grm.exceptions import AnsibleError
+
+        mock_manager.health.side_effect = AnsibleError("fail")
+        mock_manager_class.return_value = mock_manager
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["health"], input="secret\n")
+        assert result.exit_code != 0
+        assert "fail" in result.output
+
+    @patch("grm.cli.os.getlogin", side_effect=OSError("no tty"))
+    @patch("grm.cli.RunnerManager")
    def test_default_user_fallback_on_getlogin_error(
        self, mock_manager_class: MagicMock, mock_getlogin: MagicMock
    ) -> None:
@@ -868,8 +937,8 @@ class TestCLI:
            call_kwargs = mock_manager.install.call_args.kwargs
            assert call_kwargs["user"] == "testuser"

-    @patch("gitea_runner_manager.cli.os.getlogin", side_effect=OSError("no tty"))
-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.os.getlogin", side_effect=OSError("no tty"))
+    @patch("grm.cli.RunnerManager")
    def test_default_user_fallback_to_root(self, mock_manager_class: MagicMock, mock_getlogin: MagicMock) -> None:
        """os.getlogin() failure with no USER env falls back to 'root'."""
        mock_manager = MagicMock()
@@ -882,7 +951,7 @@ class TestCLI:
            call_kwargs = mock_manager.install.call_args.kwargs
            assert call_kwargs["user"] == "root"

-    @patch("gitea_runner_manager.cli.RunnerManager")
+    @patch("grm.cli.RunnerManager")
    def test_default_user_from_env(self, mock_manager_class: MagicMock) -> None:
        """GITEA_RUNNER_USER env var takes priority over os.getlogin()."""
        mock_manager = MagicMock()
@@ -901,20 +970,20 @@ class TestCLI:

    def test_get_verbose_no_context(self) -> None:
        """_get_verbose returns False when called outside Click context."""
-        from gitea_runner_manager.cli import _get_verbose
+        from grm.cli import _get_verbose

        assert _get_verbose() is False

    def test_get_become_password_file_no_context(self) -> None:
        """_get_become_password_file returns None when no context and no env vars."""
-        from gitea_runner_manager.cli import _get_become_password_file
+        from grm.cli import _get_become_password_file

        with patch.dict("os.environ", {}, clear=True):
            assert _get_become_password_file() is None

    def test_get_become_password_file_from_ansible_env(self) -> None:
        """_get_become_password_file falls back to ANSIBLE_BECOME_PASSWORD_FILE."""
-        from gitea_runner_manager.cli import _get_become_password_file
+        from grm.cli import _get_become_password_file

        with patch.dict("os.environ", {"ANSIBLE_BECOME_PASSWORD_FILE": "/tmp/ansible.txt"}, clear=True):
            assert _get_become_password_file() == "/tmp/ansible.txt"
@@ -925,7 +994,7 @@ class TestTriggerWorkflow:

    def test_trigger_workflow_success(self) -> None:
        runner = CliRunner(env=_TEST_ENV)
-        with patch("gitea_runner_manager.cli.GiteaWorkflowClient") as mock_client_cls:
+        with patch("grm.cli.GiteaWorkflowClient") as mock_client_cls:
            mock_client = MagicMock()
            mock_client_cls.return_value = mock_client
            mock_client.dispatch_workflow.return_value = {
@@ -953,7 +1022,7 @@ class TestTriggerWorkflow:

    def test_trigger_workflow_list(self) -> None:
        runner = CliRunner(env=_TEST_ENV)
-        with patch("gitea_runner_manager.cli.GiteaWorkflowClient") as mock_client_cls:
+        with patch("grm.cli.GiteaWorkflowClient") as mock_client_cls:
            mock_client = MagicMock()
            mock_client_cls.return_value = mock_client
            mock_client.list_workflows.return_value = [
@@ -968,7 +1037,7 @@ class TestTriggerWorkflow:

    def test_trigger_workflow_list_empty(self) -> None:
        runner = CliRunner(env=_TEST_ENV)
-        with patch("gitea_runner_manager.cli.GiteaWorkflowClient") as mock_client_cls:
+        with patch("grm.cli.GiteaWorkflowClient") as mock_client_cls:
            mock_client = MagicMock()
            mock_client_cls.return_value = mock_client
            mock_client.list_workflows.return_value = []
@@ -983,10 +1052,10 @@ class TestTriggerWorkflow:
        assert "WORKFLOW_ID" in result.output

    def test_trigger_workflow_api_error(self) -> None:
-        from gitea_runner_manager.gitea_client import GiteaAPIError
+        from grm.gitea_client import GiteaAPIError

        runner = CliRunner(env=_TEST_ENV)
-        with patch("gitea_runner_manager.cli.GiteaWorkflowClient") as mock_client_cls:
+        with patch("grm.cli.GiteaWorkflowClient") as mock_client_cls:
            mock_client = MagicMock()
            mock_client_cls.return_value = mock_client
            mock_client.dispatch_workflow.side_effect = GiteaAPIError(404, "workflow not found")
@@ -996,7 +1065,7 @@ class TestTriggerWorkflow:

    def test_trigger_workflow_custom_repo_and_ref(self) -> None:
        runner = CliRunner(env=_TEST_ENV)
-        with patch("gitea_runner_manager.cli.GiteaWorkflowClient") as mock_client_cls:
+        with patch("grm.cli.GiteaWorkflowClient") as mock_client_cls:
            mock_client = MagicMock()
            mock_client_cls.return_value = mock_client
            mock_client.dispatch_workflow.return_value = None
@@ -7,8 +7,8 @@ from unittest.mock import MagicMock, mock_open, patch

 import pytest

-from gitea_runner_manager.exceptions import AnsibleError
-from gitea_runner_manager.executor import AnsibleExecutor
+from grm.exceptions import AnsibleError
+from grm.executor import AnsibleExecutor


 def _mock_popen_process(returncode: int = 0) -> MagicMock:
@@ -22,7 +22,7 @@ def _mock_popen_process(returncode: int = 0) -> MagicMock:

 class TestAnsibleExecutorRun:
    def test_run_success(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.executor.say") as mock_say:
+        with patch("grm.executor.say") as mock_say:
            executor = AnsibleExecutor(log_dir=tmp_path)
            with patch("subprocess.Popen") as mock_popen, patch("builtins.open", mock_open()):
                mock_popen.return_value = _mock_popen_process(returncode=0)
@@ -33,7 +33,7 @@ class TestAnsibleExecutorRun:
        assert any("Done" in msg for msg in messages)

    def test_run_failure(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.executor.say") as mock_say:
+        with patch("grm.executor.say") as mock_say:
            executor = AnsibleExecutor(log_dir=tmp_path)
            with patch("subprocess.Popen") as mock_popen, patch("builtins.open", mock_open()):
                mock_popen.return_value = _mock_popen_process(returncode=1)
@@ -45,7 +45,7 @@ class TestAnsibleExecutorRun:
            assert "exit code 1" in error_calls[0].args[0]

    def test_run_default_description(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.executor.say") as mock_say:
+        with patch("grm.executor.say") as mock_say:
            executor = AnsibleExecutor(log_dir=tmp_path)
            with patch("subprocess.Popen") as mock_popen, patch("builtins.open", mock_open()):
                mock_popen.return_value = _mock_popen_process(returncode=0)
@@ -75,7 +75,7 @@ class TestAnsibleExecutorRun:
            '    "msg": "Runner \'127.0.0.1\' is installed and running."\n'
            "}\n"
        )
-        with patch("gitea_runner_manager.executor.say") as mock_say:
+        with patch("grm.executor.say") as mock_say:
            executor = AnsibleExecutor(log_dir=tmp_path)
            with patch("subprocess.Popen") as mock_popen, patch("builtins.open", mock_open(read_data=log_content)):
                mock_popen.return_value = _mock_popen_process(returncode=0)
@@ -111,7 +111,7 @@ class TestAnsibleExecutorExtractStatus:
        executor = AnsibleExecutor()
        log_file = tmp_path / "test.log"
        log_file.write_text("incomplete")
-        with patch("gitea_runner_manager.executor.open", side_effect=OSError("read error")):
+        with patch("grm.executor.open", side_effect=OSError("read error")):
            status = executor._extract_status(log_file)
        assert status is None

@@ -138,7 +138,7 @@ class TestAnsibleExecutorTranslation:
    def test_run_translated(self, tmp_path: Path) -> None:
        with (
            patch.dict(os.environ, {"GRM_LANG": "de"}),
-            patch("gitea_runner_manager.executor.say") as mock_say,
+            patch("grm.executor.say") as mock_say,
        ):
            executor = AnsibleExecutor(log_dir=tmp_path)
            with patch("subprocess.Popen") as mock_popen, patch("builtins.open", mock_open()):
@@ -152,7 +152,7 @@ class TestAnsibleExecutorTranslation:
    def test_unsupported_lang_fallback(self, tmp_path: Path) -> None:
        with (
            patch.dict(os.environ, {"GRM_LANG": "xx"}),
-            patch("gitea_runner_manager.executor.say") as mock_say,
+            patch("grm.executor.say") as mock_say,
        ):
            executor = AnsibleExecutor(log_dir=tmp_path)
            with patch("subprocess.Popen") as mock_popen, patch("builtins.open", mock_open()):
@@ -7,7 +7,7 @@ from unittest.mock import MagicMock, patch

 import pytest

-from gitea_runner_manager.gitea_client import GiteaAPIError, GiteaWorkflowClient
+from grm.gitea_client import GiteaAPIError, GiteaWorkflowClient


 class TestGiteaWorkflowClient:
@@ -7,7 +7,7 @@ from unittest.mock import patch

 import pytest

-import gitea_runner_manager.i18n as i18n_module
+import grm.i18n as i18n_module


 class TestI18n:
@@ -9,7 +9,7 @@ from unittest.mock import patch

 import pytest

-from gitea_runner_manager.logging_config import get_logger
+from grm.logging_config import get_logger


@pytest.fixture(autouse=True)
@@ -25,7 +25,7 @@ def _cleanup_loggers() -> Generator[None, None, None]:

 class TestGetLogger:
    def test_returns_logger(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.logging_config.Path.home", return_value=tmp_path):
+        with patch("grm.logging_config.Path.home", return_value=tmp_path):
            logger = get_logger("test_returns_logger")

        assert isinstance(logger, logging.Logger)
@@ -33,14 +33,14 @@ class TestGetLogger:
        assert len(logger.handlers) == 1  # file only

    def test_caches_same_instance(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.logging_config.Path.home", return_value=tmp_path):
+        with patch("grm.logging_config.Path.home", return_value=tmp_path):
            logger1 = get_logger("test_caches_same")
            logger2 = get_logger("test_caches_same")

        assert logger1 is logger2

    def test_file_handler_writes(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.logging_config.Path.home", return_value=tmp_path):
+        with patch("grm.logging_config.Path.home", return_value=tmp_path):
            logger = get_logger("test_file_writes")
            logger.info("hello from test")

@@ -51,7 +51,7 @@ class TestGetLogger:
        assert "INFO" in content

    def test_only_file_handler(self, tmp_path: Path) -> None:
-        with patch("gitea_runner_manager.logging_config.Path.home", return_value=tmp_path):
+        with patch("grm.logging_config.Path.home", return_value=tmp_path):
            logger = get_logger("test_only_file")

        assert len(logger.handlers) == 1
@@ -6,8 +6,8 @@ from pathlib import Path

 import pytest

-from gitea_runner_manager.exceptions import GRMError
-from gitea_runner_manager.registry import RunnerRegistry
+from grm.exceptions import GRMError
+from grm.registry import RunnerRegistry


 class TestRunnerRegistry:
@@ -6,8 +6,8 @@ from unittest.mock import patch

 import pytest

-from gitea_runner_manager.exceptions import AnsibleError
-from gitea_runner_manager.report import Step, StepTracker, track_steps
+from grm.exceptions import AnsibleError
+from grm.report import Step, StepTracker, track_steps


 class TestStep:
@@ -46,7 +46,7 @@ class TestStepTracker:

 class TestTrackSteps:
    def test_success(self) -> None:
-        with patch("gitea_runner_manager.report.say") as mock_say:
+        with patch("grm.report.say") as mock_say:
            with track_steps() as tracker:
                tracker.begin("step1")
                tracker.done()
@@ -61,7 +61,7 @@ class TestTrackSteps:
        assert any("completed" in msg for msg in messages)

    def test_failure_marks_step(self) -> None:
-        with patch("gitea_runner_manager.report.say") as mock_say:
+        with patch("grm.report.say") as mock_say:
            with pytest.raises(AnsibleError, match="fail"):
                with track_steps() as tracker:
                    tracker.begin("step1")
@@ -78,7 +78,7 @@ class TestTrackSteps:
        assert any("failed" in msg for msg in messages)

    def test_pending_shown_on_failure(self) -> None:
-        with patch("gitea_runner_manager.report.say") as mock_say:
+        with patch("grm.report.say") as mock_say:
            with pytest.raises(AnsibleError, match="fail"):
                with track_steps() as tracker:
                    tracker.begin("step1")
@@ -90,7 +90,7 @@ class TestTrackSteps:

    def test_multiple_in_progress_marked_failed(self) -> None:
        """All in-progress steps should be marked as failed on exception."""
-        with patch("gitea_runner_manager.report.say") as mock_say:
+        with patch("grm.report.say") as mock_say:
            with pytest.raises(AnsibleError, match="fail"):
                with track_steps() as tracker:
                    tracker.begin("step1")
@@ -103,7 +103,7 @@ class TestTrackSteps:
        assert messages.count("✗") >= 2 or sum(1 for m in messages if "✗" in m) >= 2

    def test_empty_report(self) -> None:
-        with patch("gitea_runner_manager.report.say") as mock_say:
+        with patch("grm.report.say") as mock_say:
            with track_steps():
                pass

@@ -112,7 +112,7 @@ class TestTrackSteps:

    def test_translated_report(self, monkeypatch: pytest.MonkeyPatch) -> None:
        monkeypatch.setenv("GRM_LANG", "bg")
-        with patch("gitea_runner_manager.report.say") as mock_say:
+        with patch("grm.report.say") as mock_say:
            with track_steps() as tracker:
                tracker.begin("step1")
                tracker.done()
@@ -8,8 +8,8 @@ from unittest.mock import MagicMock, patch

 import pytest

-from gitea_runner_manager.exceptions import AnsibleError
-from gitea_runner_manager.runner_manager import RunnerManager
+from grm.exceptions import AnsibleError
+from grm.runner_manager import RunnerManager


@contextmanager
@@ -625,6 +625,112 @@ class TestRunnerManager:
        assert manager.list_runners(no_status=True) == []


+class TestHealth:
+    """Tests for the ``health`` method."""
+
+    def test_health_single_runner_healthy(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = {"host": "10.0.0.1", "user": "ubuntu", "key": "/key"}
+        manager = RunnerManager(registry=mock_registry)
+        mock_executor = MagicMock()
+        mock_executor.run_ad_hoc.return_value = "OK: runner healthy, disk at 42%"
+        manager._executor = mock_executor
+
+        results = manager.health(name="r1")
+        assert len(results) == 1
+        assert results[0]["name"] == "r1"
+        assert results[0]["healthy"] == "yes"
+        assert "runner healthy" in results[0]["message"]
+        mock_executor.run_ad_hoc.assert_called_once()
+
+    def test_health_single_runner_unhealthy(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = {"host": "10.0.0.1", "user": "ubuntu", "key": None}
+        manager = RunnerManager(registry=mock_registry)
+        mock_executor = MagicMock()
+        mock_executor.run_ad_hoc.return_value = "CRITICAL: Docker daemon still down after restart"
+        manager._executor = mock_executor
+
+        results = manager.health(name="r1")
+        assert len(results) == 1
+        assert results[0]["healthy"] == "no"
+        assert "Docker daemon still down" in results[0]["message"]
+
+    def test_health_all_runners(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.list.return_value = {
+            "r1": {"host": "10.0.0.1", "user": "ubuntu", "key": None},
+            "r2": {"host": "10.0.0.2", "user": "ubuntu", "key": None},
+        }
+        manager = RunnerManager(registry=mock_registry)
+        mock_executor = MagicMock()
+        mock_executor.run_ad_hoc.side_effect = [
+            "OK: runner healthy, disk at 42%",
+            "ERROR: gitea-runner service is inactive, restarting",
+        ]
+        manager._executor = mock_executor
+
+        results = manager.health()
+        assert len(results) == 2
+        assert results[0]["healthy"] == "yes"
+        assert results[1]["healthy"] == "no"
+
+    def test_health_empty_registry(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.list.return_value = {}
+        manager = RunnerManager(registry=mock_registry)
+        results = manager.health()
+        assert results == []
+
+    def test_health_ansible_error(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = {"host": "10.0.0.1", "user": "ubuntu", "key": None}
+        manager = RunnerManager(registry=mock_registry)
+        mock_executor = MagicMock()
+        mock_executor.run_ad_hoc.side_effect = AnsibleError("ssh unreachable")
+        manager._executor = mock_executor
+
+        results = manager.health(name="r1")
+        assert len(results) == 1
+        assert results[0]["healthy"] == "no"
+        assert "ssh unreachable" in results[0]["message"]
+
+    def test_health_with_host_override(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = {"host": "10.0.0.1", "user": "ubuntu", "key": None}
+        manager = RunnerManager(registry=mock_registry)
+        mock_executor = MagicMock()
+        mock_executor.run_ad_hoc.return_value = "OK: runner healthy, disk at 50%"
+        manager._executor = mock_executor
+
+        results = manager.health(name="r1", host="10.0.0.99", user="root")
+        assert len(results) == 1
+        assert results[0]["host"] == "10.0.0.99"
+        call_args = mock_executor.run_ad_hoc.call_args.args
+        assert call_args[0] == "10.0.0.99"
+        assert call_args[1] == "root"
+
+    def test_health_runner_not_found(self) -> None:
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = None
+        manager = RunnerManager(registry=mock_registry)
+        with pytest.raises(AnsibleError, match="not found in registry"):
+            manager.health(name="nonexistent")
+
+    def test_health_passes_become_pass(self) -> None:
+        """become_pass is forwarded to run_ad_hoc for sudo authentication."""
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = {"host": "10.0.0.1", "user": "ubuntu", "key": None}
+        manager = RunnerManager(registry=mock_registry)
+        mock_executor = MagicMock()
+        mock_executor.run_ad_hoc.return_value = "OK: runner healthy, disk at 42%"
+        manager._executor = mock_executor
+
+        manager.health(name="r1", become_pass="s3cr3t")
+        call_kwargs = mock_executor.run_ad_hoc.call_args.kwargs
+        assert call_kwargs["become_pass"] == "s3cr3t"
+
+
 class TestExtraVarsFile:
    """Tests for the ``_extra_vars_file`` context manager."""

@@ -7,7 +7,7 @@ from unittest.mock import patch

 import pytest

-from gitea_runner_manager.ui import _console_level, say
+from grm.ui import _console_level, say


 class TestConsoleLevel:
@@ -26,15 +26,15 @@ class TestConsoleLevel:

 class TestSay:
    def test_echoes_to_console(self) -> None:
-        with patch("gitea_runner_manager.ui.click.echo") as mock_echo:
+        with patch("grm.ui.click.echo") as mock_echo:
            say("hello")

        mock_echo.assert_called_once_with("hello", err=False)

    def test_logs_at_info_level(self) -> None:
        with (
-            patch("gitea_runner_manager.ui.click.echo"),
-            patch("gitea_runner_manager.ui.logging.getLogger") as mock_get_logger,
+            patch("grm.ui.click.echo"),
+            patch("grm.ui.logging.getLogger") as mock_get_logger,
        ):
            mock_logger = mock_get_logger.return_value
            say("hello")
@@ -43,8 +43,8 @@ class TestSay:

    def test_passes_level_and_err(self) -> None:
        with (
-            patch("gitea_runner_manager.ui.click.echo") as mock_echo,
-            patch("gitea_runner_manager.ui.logging.getLogger") as mock_get_logger,
+            patch("grm.ui.click.echo") as mock_echo,
+            patch("grm.ui.logging.getLogger") as mock_get_logger,
        ):
            mock_logger = mock_get_logger.return_value
            say("error msg", level=logging.ERROR, err=True)
@@ -55,8 +55,8 @@ class TestSay:
    def test_suppresses_console_below_level(self, monkeypatch: pytest.MonkeyPatch) -> None:
        monkeypatch.setenv("GRM_LOG_LEVEL", "WARNING")
        with (
-            patch("gitea_runner_manager.ui.click.echo") as mock_echo,
-            patch("gitea_runner_manager.ui.logging.getLogger") as mock_get_logger,
+            patch("grm.ui.click.echo") as mock_echo,
+            patch("grm.ui.logging.getLogger") as mock_get_logger,
        ):
            mock_logger = mock_get_logger.return_value
            say("debug msg", level=logging.DEBUG)
@@ -504,7 +504,7 @@ wheels = [
 ]

 [[package]]
-name = "gitea-runner-manager"
+name = "grm"
 version = "0.1.0"
 source = { editable = "." }
 dependencies = [
Author	SHA1	Message	Date
grm-ci-bot	8a41b1237d	release: v0.14.3 [skip ci]	2026-07-06 06:08:28 +00:00
emil	34742bab40	GRM-136: refactor: rename PyPI package from gitea-runner-manager to grm Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 1m14s Details Post-merge / validate-commit-msg (push) Successful in 1m25s Details Post-merge / vikunja (push) Successful in 1m21s Details Post-merge / badges (push) Successful in 1m45s Details Post-merge / configure-repo (push) Successful in 1m15s Details Post-merge / sync-wiki (push) Successful in 3m5s Details Post-merge / publish (push) Successful in 1m1s Details	2026-07-06 06:06:13 +00:00
gitea-actions-bot	d3dbb17cc2	chore: update badge URLs to commit 08460d07 [skip ci]	2026-07-06 05:21:16 +00:00
emil	751f594ce5	GRM-135: chore: bump devx to 0.33.3 Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 1m1s Details Post-merge / validate-commit-msg (push) Successful in 1m26s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m32s Details Post-merge / configure-repo (push) Successful in 1m19s Details Post-merge / vikunja (push) Successful in 1m31s Details Post-merge / sync-wiki (push) Successful in 3m0s Details	2026-07-06 05:18:44 +00:00
gitea-actions-bot	d8caebee2d	chore: update badge URLs to commit 089dfa2e [skip ci]	2026-07-06 04:55:07 +00:00
emil	bb4cc80a98	GRM-134: ci: add concurrency group and increase timeout for sync-wiki Post-merge / detect-type (push) Successful in 1m0s Details Post-merge / release (push) Successful in 47s Details Post-merge / validate-commit-msg (push) Successful in 1m18s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m29s Details Post-merge / vikunja (push) Successful in 1m12s Details Post-merge / configure-repo (push) Successful in 1m12s Details Post-merge / sync-wiki (push) Successful in 2m38s Details	2026-07-06 04:52:12 +00:00
gitea-actions-bot	e0b2e64b8e	chore: update badge URLs to commit f8b1b5df [skip ci]	2026-07-05 20:52:42 +00:00
emil	00404cb484	GRM-133: ci: rename doc-syncer to doc-sync-specialist for consistency Post-merge / detect-type (push) Successful in 1m0s Details Post-merge / release (push) Successful in 46s Details Post-merge / validate-commit-msg (push) Successful in 1m15s Details Post-merge / publish (push) Has been skipped Details Post-merge / vikunja (push) Successful in 1m23s Details Post-merge / badges (push) Successful in 1m30s Details Post-merge / configure-repo (push) Successful in 1m14s Details Post-merge / sync-wiki (push) Successful in 3m8s Details	2026-07-05 20:49:16 +00:00
gitea-actions-bot	1a30b595dc	chore: update badge URLs to commit ab3c0809 [skip ci]	2026-07-05 15:10:28 +00:00
grm-ci-bot	3538eb0803	release: v0.14.2 [skip ci]	2026-07-05 15:09:04 +00:00
emil	5a93559b79	GRM-132: ci: bump devx to 0.33.0, use devx-check-api-identity-checks Post-merge / detect-type (push) Successful in 50s Details Post-merge / validate-commit-msg (push) Successful in 1m5s Details Post-merge / release (push) Successful in 1m11s Details Post-merge / vikunja (push) Successful in 1m3s Details Post-merge / badges (push) Successful in 1m17s Details Post-merge / configure-repo (push) Successful in 1m3s Details Post-merge / publish (push) Successful in 1m2s Details Post-merge / sync-wiki (push) Successful in 2m38s Details	2026-07-05 15:07:03 +00:00
gitea-actions-bot	e30acbe213	chore: update badge URLs to commit bdbbfb7b [skip ci]	2026-07-02 17:01:50 +00:00
emil	386f3a88c6	GRM-131: ci: remove redundant devx reinstall in doc lint step Post-merge / detect-type (push) Successful in 1m3s Details Post-merge / publish (push) Has been skipped Details Post-merge / release (push) Successful in 57s Details Post-merge / validate-commit-msg (push) Successful in 1m5s Details Post-merge / sync-wiki (push) Successful in 2m42s Details Post-merge / vikunja (push) Successful in 1m3s Details Post-merge / configure-repo (push) Successful in 1m1s Details Post-merge / badges (push) Successful in 1m13s Details	2026-07-02 16:58:01 +00:00
gitea-actions-bot	e99e9d0ac8	chore: update badge URLs to commit 7e626586 [skip ci]	2026-07-01 23:40:46 +00:00
emil	ca1d8e5cc0	GRM-130: fix: add pre-commit hooks for quality gates matching CI Post-merge / detect-type (push) Successful in 1m8s Details Post-merge / release (push) Successful in 1m15s Details Post-merge / vikunja (push) Successful in 1m38s Details Post-merge / validate-commit-msg (push) Successful in 1m44s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m49s Details Post-merge / sync-wiki (push) Successful in 2m28s Details Post-merge / configure-repo (push) Successful in 1m21s Details	2026-07-01 23:37:28 +00:00
gitea-actions-bot	83e800c900	chore: update badge URLs to commit b0888676 [skip ci]	2026-07-01 23:14:33 +00:00
grm-ci-bot	be17dc278c	release: v0.14.1 [skip ci]	2026-07-01 23:14:00 +00:00
emil	58b8d5b5de	GRM-130: chore: bump devx to 0.32.0, add devx.mak include fallback Post-merge / detect-type (push) Successful in 1m12s Details Post-merge / release (push) Successful in 1m4s Details Post-merge / validate-commit-msg (push) Successful in 1m8s Details Post-merge / badges (push) Successful in 1m27s Details Post-merge / publish (push) Successful in 1m8s Details Post-merge / sync-wiki (push) Successful in 2m38s Details Post-merge / vikunja (push) Successful in 1m44s Details Post-merge / configure-repo (push) Successful in 1m42s Details	2026-07-01 23:11:49 +00:00
gitea-actions-bot	48f23b554f	chore: update badge URLs to commit 627be1f1 [skip ci]	2026-07-01 22:25:36 +00:00
emil	d32bb40cbd	GRM-130: refactor: align venv management to devx.mak targets Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 59s Details Post-merge / publish (push) Has been skipped Details Post-merge / validate-commit-msg (push) Successful in 1m32s Details Post-merge / configure-repo (push) Successful in 1m34s Details Post-merge / vikunja (push) Successful in 1m38s Details Post-merge / badges (push) Successful in 1m46s Details Post-merge / sync-wiki (push) Successful in 2m34s Details	2026-07-01 22:22:50 +00:00
gitea-actions-bot	34954aa396	chore: update badge URLs to commit 93c752fe [skip ci]	2026-07-01 20:57:47 +00:00
emil	b9d728334f	GRM-129: docs: add container-level fix verification and verified state modification rules Post-merge / detect-type (push) Successful in 49s Details Post-merge / release (push) Successful in 1m3s Details Post-merge / publish (push) Has been skipped Details Post-merge / validate-commit-msg (push) Successful in 1m9s Details Post-merge / vikunja (push) Successful in 1m7s Details Post-merge / badges (push) Successful in 1m17s Details Post-merge / configure-repo (push) Successful in 56s Details Post-merge / sync-wiki (push) Successful in 2m8s Details	2026-07-01 20:55:35 +00:00
gitea-actions-bot	02d7c02a19	chore: update badge URLs to commit 95cb0d84 [skip ci]	2026-07-01 14:20:51 +00:00
grm-ci-bot	f861d14f32	release: v0.14.0 [skip ci]	2026-07-01 14:20:20 +00:00
emil	4359dbdc26	GRM-128: feat: bump devx to v0.30.0 Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 1m9s Details Post-merge / validate-commit-msg (push) Successful in 1m13s Details Post-merge / badges (push) Successful in 1m32s Details Post-merge / publish (push) Successful in 1m15s Details Post-merge / vikunja (push) Successful in 1m22s Details Post-merge / configure-repo (push) Successful in 1m25s Details Post-merge / sync-wiki (push) Successful in 2m47s Details	2026-07-01 14:18:24 +00:00
gitea-actions-bot	fc494f5cc0	chore: update badge URLs to commit 647c885c [skip ci]	2026-07-01 10:32:00 +00:00
grm-ci-bot	461ec207ad	release: v0.13.0 [skip ci]	2026-07-01 10:30:21 +00:00
emil	dca82753b2	GRM-127: feat: bump devx to v0.29.1, upgrade molecule, ubuntu 26.04 Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 1m30s Details Post-merge / validate-commit-msg (push) Successful in 1m48s Details Post-merge / vikunja (push) Successful in 2m1s Details Post-merge / configure-repo (push) Successful in 1m18s Details Post-merge / publish (push) Successful in 1m21s Details Post-merge / badges (push) Successful in 3m4s Details Post-merge / sync-wiki (push) Successful in 3m34s Details	2026-07-01 10:27:58 +00:00
gitea-actions-bot	3b952b09b5	chore: update badge URLs to commit b8aa4072 [skip ci]	2026-07-01 01:07:14 +00:00
emil	833792d0ad	GRM-125: ci: bump devx to v0.28.0, add pre-merge-check, agent docs Post-merge / detect-type (push) Successful in 55s Details Post-merge / release (push) Successful in 1m16s Details Post-merge / validate-commit-msg (push) Successful in 1m18s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m31s Details Post-merge / vikunja (push) Successful in 1m20s Details Post-merge / configure-repo (push) Successful in 1m18s Details Post-merge / sync-wiki (push) Successful in 2m13s Details	2026-07-01 01:04:26 +00:00
gitea-actions-bot	d8a90eaea1	chore: update badge URLs to commit 6a2a9bb9 [skip ci]	2026-07-01 00:21:16 +00:00
emil	358620401d	GRM-124: docs: fix outdated references and document health/restart/trigger-workflow commands Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 59s Details Post-merge / validate-commit-msg (push) Successful in 1m20s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m43s Details Post-merge / sync-wiki (push) Successful in 2m5s Details Post-merge / vikunja (push) Successful in 1m9s Details Post-merge / configure-repo (push) Successful in 1m8s Details	2026-07-01 00:18:44 +00:00
gitea-actions-bot	32f0ad5cb3	chore: update badge URLs to commit 2db35931 [skip ci]	2026-06-30 23:31:22 +00:00
grm-ci-bot	4e9d033a40	release: v0.12.5 [skip ci]	2026-06-30 23:30:56 +00:00
emil	63ef5cdbcf	GRM-123: fix: cast disk threshold to string in template-content verify assertion Post-merge / detect-type (push) Successful in 49s Details Post-merge / validate-commit-msg (push) Successful in 1m6s Details Post-merge / vikunja (push) Successful in 1m11s Details Post-merge / release (push) Successful in 1m21s Details Post-merge / badges (push) Successful in 1m37s Details Post-merge / configure-repo (push) Successful in 1m20s Details Post-merge / publish (push) Successful in 57s Details Post-merge / sync-wiki (push) Successful in 2m35s Details	2026-06-30 23:28:54 +00:00
gitea-actions-bot	8fbe2d3f51	chore: update badge URLs to commit ec6dc73a [skip ci]	2026-06-29 12:04:56 +00:00
emil	a9178714af	GRM-122: fix: right-size molecule-tests matrix to [1-6] Post-merge / detect-type (push) Successful in 1m2s Details Post-merge / release (push) Successful in 1m0s Details Post-merge / validate-commit-msg (push) Successful in 1m3s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m11s Details Post-merge / vikunja (push) Successful in 1m14s Details Post-merge / sync-wiki (push) Successful in 1m34s Details Post-merge / configure-repo (push) Successful in 1m15s Details	2026-06-29 12:02:41 +00:00
gitea-actions-bot	6ffcc38181	chore: update badge URLs to commit f47c3dff [skip ci]	2026-06-29 11:56:25 +00:00
grm-ci-bot	e5b0e17ec3	release: v0.12.4 [skip ci]	2026-06-29 11:55:20 +00:00
emil	dc5e1431b5	GRM-121: fix: use hardcoded matrix array for Gitea 1.26 compatibility Post-merge / detect-type (push) Successful in 1m12s Details Post-merge / release (push) Successful in 48s Details Post-merge / validate-commit-msg (push) Successful in 1m41s Details Post-merge / vikunja (push) Successful in 1m38s Details Post-merge / configure-repo (push) Successful in 1m37s Details Post-merge / badges (push) Successful in 1m48s Details Post-merge / publish (push) Successful in 1m11s Details Post-merge / sync-wiki (push) Successful in 2m10s Details	2026-06-29 11:53:22 +00:00
gitea-actions-bot	dfa8d77bfa	chore: update badge URLs to commit 26565ddc [skip ci]	2026-06-29 11:39:57 +00:00
emil	a178b1b5d2	GRM-120: chore: pin devx to 0.27.2 for dynamic runner matrix support Post-merge / detect-type (push) Successful in 53s Details Post-merge / release (push) Successful in 1m13s Details Post-merge / validate-commit-msg (push) Successful in 1m44s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m53s Details Post-merge / vikunja (push) Successful in 1m52s Details Post-merge / sync-wiki (push) Successful in 2m10s Details Post-merge / configure-repo (push) Successful in 1m34s Details	2026-06-29 11:37:03 +00:00
gitea-actions-bot	99529a57af	chore: update badge URLs to commit f731a4a7 [skip ci]	2026-06-29 10:41:23 +00:00
grm-ci-bot	0eb033419f	release: v0.12.3 [skip ci]	2026-06-29 10:40:45 +00:00
emil	df4b7f2a19	GRM-118: fix: improve runner service stability and deregistration Post-merge / detect-type (push) Successful in 1m16s Details Post-merge / release (push) Successful in 1m12s Details Post-merge / validate-commit-msg (push) Successful in 1m27s Details Post-merge / configure-repo (push) Successful in 1m27s Details Post-merge / vikunja (push) Successful in 1m31s Details Post-merge / badges (push) Successful in 1m33s Details Post-merge / sync-wiki (push) Successful in 1m43s Details Post-merge / publish (push) Successful in 46s Details	2026-06-29 10:38:32 +00:00
gitea-actions-bot	312a706d39	chore: update badge URLs to commit 695921d6 [skip ci]	2026-06-28 17:09:22 +00:00
emil	ea2f0cc600	GRM-117: fix: fix wiki link URLs, heading hierarchy, quote pip install vars Post-merge / detect-type (push) Successful in 51s Details Post-merge / release (push) Successful in 54s Details Post-merge / validate-commit-msg (push) Successful in 1m5s Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 1m17s Details Post-merge / vikunja (push) Successful in 1m26s Details Post-merge / configure-repo (push) Successful in 1m12s Details Post-merge / sync-wiki (push) Successful in 1m34s Details	2026-06-28 17:07:11 +00:00
gitea-actions-bot	bd8e13ee66	chore: update badge URLs to commit 622165d8 [skip ci]	2026-06-28 15:06:01 +00:00
grm-ci-bot	41fc36ff4a	release: v0.12.2 [skip ci]	2026-06-28 15:05:36 +00:00
emil	e585543e9d	GRM-116: fix: bump devx to 0.26.3 (latest with pinned deps) Post-merge / detect-type (push) Successful in 56s Details Post-merge / release (push) Successful in 1m12s Details Post-merge / validate-commit-msg (push) Successful in 1m15s Details Post-merge / vikunja (push) Successful in 1m20s Details Post-merge / badges (push) Successful in 1m34s Details Post-merge / sync-wiki (push) Successful in 2m0s Details Post-merge / configure-repo (push) Successful in 1m26s Details Post-merge / publish (push) Successful in 1m0s Details	2026-06-28 15:03:33 +00:00
gitea-actions-bot	c62c35f5b6	chore: update badge URLs to commit ab26a799 [skip ci]	2026-06-28 14:57:29 +00:00
grm-ci-bot	4b900ce673	release: v0.12.1 [skip ci]	2026-06-28 14:56:55 +00:00
emil	cae66e0743	GRM-114: fix: add approval step to auto-merge workflow using REVIEW_GITEA_TOKEN Post-merge / detect-type (push) Successful in 1m6s Details Post-merge / release (push) Successful in 1m13s Details Post-merge / validate-commit-msg (push) Successful in 1m17s Details Post-merge / vikunja (push) Successful in 1m18s Details Post-merge / badges (push) Successful in 1m25s Details Post-merge / configure-repo (push) Successful in 1m14s Details Post-merge / sync-wiki (push) Successful in 1m56s Details Post-merge / publish (push) Successful in 1m4s Details	2026-06-28 14:54:53 +00:00
gitea-actions-bot	0b3a76c550	chore: update badge URLs to commit b73d161e [skip ci]	2026-06-28 13:15:36 +00:00