fix: remove non-existent wait_for_checks step from auto-merge

The become_user pattern with sudo doesn't reliably connect to the
user's D-Bus session, causing systemd user timers (docker-prune,
runner-healthcheck) to silently fail to enable. This led to stale
Docker images accumulating and filling the disk on CI runners.

Switch all systemctl --user invocations to use runuser with explicit
XDG_RUNTIME_DIR and DBUS_SESSION_BUS_ADDRESS environment variables,
which correctly connects to the user's systemd session.

Affected tasks: prune timer, healthcheck timer, gitea-runner service,
rootless Docker daemon start/enable/restart, runner service restart.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.devin/skills/devx-workflow/SKILL.md

@@ -12,6 +12,7 @@ Quick reference for devx tools when working on this repo.
 | Check CI status | `make devx-pr-status` or `make devx-pr-status PR=42 WAIT=1` |
 | Fetch CI failure logs | `make devx-pr-logs` or `make devx-pr-logs PR=42 JOB=quality TAIL=50` |
 | Add ready-to-merge label | `make devx-pr-label` or `make devx-pr-label PR=42` |
+| Post PR review | `make devx-pr-review PR=42 EVENT=APPROVE BODY="..." CHECKLIST=1,2,3,4,5,6,7,8,9,10,11,12,13` |
 | Rebase current branch | `make rebase` |
 | Rebase PR via API | `make pr-rebase` or `make pr-rebase PR=42` |
 
@@ -29,25 +30,6 @@ CI runs a `pre-merge-check` job early (after quality + detect-changes)
 that validates branch format, PR title, and Vikunja task match.
 This fails fast before expensive molecule tests run.
 
-## Spec-Driven CI Gates (Pre-merge)
-
-Every PR must pass these gates before merge:
-
-| Gate | Module | What it checks |
-|------|--------|----------------|
-| Spec validation | `devx.ci.validate_spec` | Spec file exists at `docs/specs/<TASK-ID>.md`, has REQ-IDs, all ACs checked |
-| PR size | `devx.ci.check_pr_size` | Max 500 lines / 10 files (excludes CHANGELOG, badges, locks) |
-
-Full molecule tests still run on every PR (6 scenarios, all platforms).
-
-## Post-merge Auto-publish + Dependency PR
-
-After merge to master, `post-merge.yml`:
-1. Runs release (git-cliff semver, tags, publishes to Gitea PyPI)
-2. Auto-creates an infra dependency PR (`devx.ci.create_dependency_pr`)
-   to bump the pinned grm version in `infra/pyproject.toml`
-3. Syncs wiki, updates Vikunja task, pushes badges
-
 ## Key Rules
 
 - Never manually merge via API — always use auto-merge with `ready-to-merge` label

.devin/skills/pr-review/SKILL.md

@@ -1,272 +0,0 @@
-# pr-review
-
-Deep, critical PR review with auto-fix. This skill guides the agent
-through a thorough review of a pull request, posting inline comments
-for each issue found, auto-fixing them, resolving the discussion threads,
-and marking the PR as ready-to-merge when no blocking issues remain.
-
-## When to Invoke
-
-Invoke this skill when asked to review a PR, or when a PR is open and
-needs review before merge. Do NOT invoke automatically on every PR —
-this is an on-demand deep review, not a CI gate.
-
-## Prerequisites
-
-- The PR must be open in a Gitea repo
-- The agent needs Gitea MCP access (gitea server)
-- The agent needs git push access to the PR's head branch
-- The PR should have passed CI (validate job) before deep review
-
-## Review Categories
-
-Review every PR against these 8 categories. For each issue found, post
-an inline comment on the specific line, then auto-fix it.
-
-### 1. Functional Correctness
-
-- Does the code actually do what the spec/PR title claims?
-- Are edge cases handled? (empty input, null, boundary values, concurrent access)
-- Are error paths tested? Not just happy path.
-- Does the code handle all return values? (ignored errors, unchecked None)
-- Are there off-by-one errors, wrong comparisons, inverted conditions?
-- Do loops terminate correctly? (no infinite loops, correct break/continue)
-- Are regex patterns correct? (anchored, escaped, non-greedy where needed)
-- Are API responses validated before use? (status codes, response shape)
-
-### 2. Completeness
-
-- Are all requirements from the spec implemented? (check each REQ-ID)
-- Are all acceptance criteria in the spec checked off?
-- Are tests written for all new code paths?
-- Are error messages user-facing (wrapped in `_()`)?
-- Are new CLI commands documented in `docs/user/cli-commands.md`?
-- Are new modules added to architecture docs?
-- Are CHANGELOG entries added for user-facing changes?
-- Are translations added for new user-facing strings?
-
-### 3. Architecture
-
-- Does the code follow the repo's layer separation? (no business logic in CLI, no direct subprocess in CLI)
-- Are new dependencies justified? (no unnecessary new packages)
-- Is configuration via env vars / config.py, not hardcoded?
-- Are new modules placed in the correct directory? (ci/ vs tools/ vs molecule/)
-- Does the code reuse existing utilities? (no reimplemented helpers)
-- Are imports circular? (check import chains)
-- Is the code testable? (injectable dependencies, no hidden global state)
-- Does the code follow existing patterns in the codebase?
-
-### 4. Reliability
-
-- Are external API calls retried with backoff?
-- Are timeouts set on all network operations?
-- Are file operations atomic? (write to temp, rename)
-- Are database operations transactional where needed?
-- Are there race conditions? (check shared mutable state)
-- Are resources cleaned up in all paths? (finally blocks, context managers)
-- Can the code handle partial failures? (one service down, others up)
-- Are idempotency guarantees maintained? (safe to retry)
-
-### 5. Robustness
-
-- Does the code fail gracefully? (meaningful error messages, not stack traces)
-- Are unexpected inputs handled? (type checking, validation)
-- Are there any crash-on-bad-input paths?
-- Does the code degrade under load? (backpressure, queue limits)
-- Are there resource leaks? (file handles, connections, memory)
-- Does the code survive network partitions? (retry, circuit breaker)
-- Are there any unhandled exceptions that could crash the process?
-- Is logging sufficient to diagnose production issues?
-
-### 6. Security
-
-- Are there hardcoded secrets, tokens, or passwords?
-- Is `shell=True` used with user input? (command injection)
-- Is `eval()` or `exec()` used? (code injection)
-- Are SQL queries parameterized? (no string concatenation)
-- Are file paths validated? (no path traversal)
-- Are user inputs sanitized before display? (XSS in web contexts)
-- Are SSL/TLS verifications disabled without justification?
-- Are secrets logged in error messages or debug output?
-- Are permissions checked before privileged operations?
-- Is sensitive data in memory longer than necessary?
-
-### 7. Technical Excellence
-
-- Are functions under 50 lines? (refactor if longer)
-- Is cyclomatic complexity reasonable? (no deeply nested if/else chains)
-- Are names meaningful? (no single-letter vars, no misleading names)
-- Is dead code removed? (no commented-out blocks, no unused imports)
-- Are comments explaining WHY, not WHAT?
-- Is the code DRY? (no copy-pasted blocks that should be shared)
-- Is the code SOLID? (single responsibility, open/closed)
-- Are magic numbers extracted to named constants?
-- Is the code formatted per the repo's linter config?
-- Are type hints present on all function signatures?
-
-### 8. Test Quality
-
-- Do tests actually test the behavior? (not just that code runs)
-- Are tests independent? (no shared mutable state, no order dependency)
-- Are tests fast? (no real sleeps, no real network calls, mocked)
-- Are edge cases tested? (empty, None, boundary, error paths)
-- Are test names descriptive? (test_what_condition_expected_result)
-- Are mocks set up correctly? (mocking the right object, not too broad)
-- Is coverage 100% for new code? (every branch, every line)
-- Are integration tests added for cross-module changes?
-- Do tests clean up after themselves? (tmp_path, fixtures)
-
-## Review Procedure
-
-### Step 1: Gather Context
-
-```
-1. Read the PR spec (if exists): docs/specs/<TASK-ID>.md
-2. Fetch PR details via Gitea MCP: pull_request_read (get_pr, list_pr_files)
-3. Read the full diff: git diff origin/master...HEAD
-4. Read the PR description and any existing review comments
-5. Identify the repo's task prefix (OBL-INFRA, GRM, SSO, DEVX)
-```
-
-### Step 2: Review Each File
-
-For each changed file in the PR:
-
-1. Read the full file (not just the diff) to understand context
-2. Go through all 8 review categories
-3. For each issue found, note: file path, line number, category, severity, description, suggested fix
-
-### Step 3: Post Inline Comments
-
-For each issue found, post an inline review comment using the Gitea MCP:
-
-```
-mcp_call_tool: gitea / pull_request_review_write
-  method: create
-  owner: <owner>
-  repo: <repo>
-  pull_number: <PR number>
-  state: PENDING  (accumulate comments before submitting)
-  body: ""  (empty for now, summary added on submit)
-  comments: [
-    {
-      path: "<file path>",
-      new_line_num: <line number>,
-      body: "**[<category>] [<severity>]** <description>\n\n**Suggested fix:**\n```<lang>\n<fixed code>\n```"
-    }
-  ]
-```
-
-Comment format:
-```
-**[Security] [error]** `shell=True` used with user input — command injection risk.
-
-**Suggested fix:**
-```python
-subprocess.run(["git", "log", commit], check=True)
-```
-```
-
-Severity levels:
-- `error` — must fix before merge (security, correctness, crash)
-- `warning` — should fix before merge (reliability, best practice)
-- `info` — consider fixing (style, minor improvement)
-
-### Step 4: Auto-Fix Issues
-
-For each issue that can be safely auto-fixed:
-
-1. Edit the file using the `edit` tool
-2. Commit with message: `fix: address review comment — <short description>`
-3. Push to the PR's head branch: `git push origin HEAD`
-4. Wait for CI to re-run on the push
-
-Auto-fix ALL issues unless:
-- The fix requires an architectural decision (ask the user)
-- The fix changes public API behavior (ask the user)
-- The fix is ambiguous (multiple valid approaches, ask the user)
-
-### Step 5: Resolve Discussion Threads
-
-After auto-fixing an issue and CI passes:
-
-1. Find the review comment thread for that issue
-2. Post a reply: `Fixed in <commit-sha>. Closing this thread.`
-3. Resolve the discussion (if Gitea supports it via API)
-4. If resolving via API is not available, the reply comment serves as resolution
-
-### Step 6: Submit Final Review
-
-After all issues are addressed (fixed or discussed):
-
-```
-mcp_call_tool: gitea / pull_request_review_write
-  method: submit
-  owner: <owner>
-  repo: <repo>
-  pull_number: <PR number>
-  review_id: <from step 3 create>
-  state: COMMENT  (or APPROVED if no blocking issues remain)
-  body: <summary — see below>
-```
-
-### Step 7: Post Summary
-
-Post a brief summary as a PR comment (via `issue_write / add_comment`):
-
-```
-## Deep Review Summary
-
-- **Files reviewed:** N
-- **Issues found:** N (N auto-fixed, N require attention)
-- **Categories:** security (N), correctness (N), architecture (N), ...
-
-**Outcome:** ✅ Ready to merge — all issues addressed.
-**OR**
-**Outcome:** ⚠️ N blocking issue(s) remain — see inline comments.
-```
-
-Keep the summary to 5-10 bullet points. Do not paste the full review.
-
-### Step 8: Mark PR Ready
-
-If all issues are addressed and no blocking issues remain:
-
-```
-mcp_call_tool: gitea / issue_write
-  method: add_labels
-  owner: <owner>
-  repo: <repo>
-  issue_number: <PR number>
-  labels: [<label_id for "ready-to-merge">]
-```
-
-If blocking issues remain, do NOT add the label. Post a comment
-explaining what needs to be resolved before the PR can merge.
-
-## Gitea MCP Tools Reference
-
-| Action | MCP tool | Method |
-|--------|----------|--------|
-| Get PR details | `pull_request_read` | `get_pr` |
-| List PR files | `pull_request_read` | `list_pr_files` |
-| Get PR diff | `pull_request_read` | `get_pr_diff` |
-| Create review (pending) | `pull_request_review_write` | `create` (state: PENDING) |
-| Submit review | `pull_request_review_write` | `submit` (state: APPROVED/COMMENT/REQUEST_CHANGES) |
-| Post PR comment | `issue_write` | `add_comment` |
-| Add label | `issue_write` | `add_labels` |
-| List labels | `label_read` | `list_repo_labels` |
-| Merge PR | `pull_request_write` | `merge` (do NOT use — auto-merge handles this) |
-
-## Important Rules
-
-- **Never merge the PR yourself.** Add the `ready-to-merge` label and let
-  the auto-merge workflow handle it. This ensures CI passes and the
-  commit message follows the `<PREFIX>-N: <conventional>` format.
-- **Never approve your own PR.** If the agent created the PR, post
-  COMMENT state, not APPROVED.
-- **Always push fixes to the PR branch**, not directly to master.
-- **Wait for CI after each push** before resolving the discussion thread.
-- **Post one review with all comments**, not multiple reviews.
-- **The summary must be brief** — 5-10 bullet points max.
-- **Severity matters**: only `error` severity blocks the `ready-to-merge` label.

.devin/skills/spec-driven-development/SKILL.md

@@ -1,130 +0,0 @@
-# Spec-Driven Development
-
-## Overview
-
-Every change starts with a spec. No spec, no code. No code, no PR.
-
-The spec is a markdown file at `docs/specs/<TASK-ID>.md` in the repo.
-It contains structured requirements (REQ-IDs) and acceptance criteria
-(AC checklist) that CI validates before merge.
-
-## Workflow
-
-1. **Create Vikunja task** — `make create-task -- --title "Title" --description "..."`
-2. **Write spec** — Create `docs/specs/<TASK-ID>.md` (see template below)
-3. **Create branch** — `git checkout -b <PREFIX>-N-short-description`
-4. **Implement** — Write code with `# Implements: REQ-N` comments
-5. **Check ACs** — Tick all acceptance criteria checkboxes in the spec
-6. **Push and create PR** — `make push-with-pr`
-7. **CI validates** — Spec validation, PR size check, fast molecule, lint, tests
-8. **Auto-merge** — Add `ready-to-merge` label after review
-9. **Auto-deploy** — Post-merge deploys to staging (if nightly gate is green)
-
-## Spec Template
-
-```markdown
-# <TASK-ID>: <Title>
-
-## Problem
-<What is broken or missing? Why does this change exist?>
-
-## Approach
-<How will you solve it? What are the key design decisions?>
-
-REQ-1: <First requirement description>
-REQ-2: <Second requirement description>
-REQ-3: <Third requirement description>
-
-## Test Plan
-- <How will you verify each REQ is implemented correctly?>
-- <Include unit tests, molecule scenarios, integration tests>
-
-## Deploy Plan
-- <How will this change be deployed?>
-- <What order do components need to deploy in?>
-- <Are there migrations or one-time operations?>
-
-## Rollback Plan
-- <How do you revert if something goes wrong?>
-- <What data/state changes are irreversible?>
-
-## Acceptance Criteria
-- [ ] REQ-1: <criterion that proves REQ-1 is done>
-- [ ] REQ-2: <criterion that proves REQ-2 is done>
-- [ ] REQ-3: <criterion that proves REQ-3 is done>
-```
-
-## CI Validation
-
-The `devx.ci.validate_spec` module checks:
-
-1. **Spec file exists** at `docs/specs/<TASK-ID>.md` (TASK-ID from branch name)
-2. **Required sections present**: Problem, Approach, Test Plan, Deploy Plan, Rollback Plan, Acceptance Criteria
-3. **At least one REQ-ID** line (format: `REQ-N: <description>`)
-4. **All AC checkboxes checked** (`- [x]`, not `- [ ]`)
-
-If any check fails, CI blocks the PR before expensive jobs run.
-
-## PR Size Limits
-
-CI enforces max 500 lines / 10 files changed (excluding CHANGELOG.md,
-README.md, badges, lock files). Oversized PRs are rejected. Split your
-work into smaller PRs.
-
-## Code-to-Spec Linking
-
-Each function, task, or template that implements a requirement should
-have a comment:
-
-```python
-# Implements: REQ-1
-def install_sso_bridge():
-    ...
-```
-
-```yaml
-# Implements: REQ-2
-- name: Clone infra repo
-  git:
-    ...
-```
-
-## Fast Molecule (Pre-merge)
-
-CI runs molecule only for **changed roles** (detected via git diff),
-with converge + verify only, single platform. This gives quick feedback
-(~5-10 min) without the full molecule suite.
-
-## Full Molecule (Nightly)
-
-The complete molecule suite (all scenarios, all platforms) runs nightly
-at 02:00 CET on master. If it fails:
-- A Gitea issue is created with the `feedback` label
-- The `NIGHTLY_STATUS` repo variable is set to `failed:<run_id>`
-- All staging deploys are blocked until nightly passes again
-
-## Auto-Deploy on Merge
-
-Every merged PR auto-deploys to staging (if nightly gate is green).
-No manual trigger needed. The deploy runs the full pipeline:
-provision → deploy-observability → deploy-customer → configure-oidc.
-
-For grm/sso-bridge: post-merge publishes the package, then auto-creates
-an infra PR to bump the pinned version. That infra PR auto-deploys when
-merged.
-
-## Key Commands
-
-```bash
-# Validate spec locally (before pushing)
-python -m devx.ci.validate_spec --branch <PREFIX>-N-description
-
-# Check PR size locally
-python -m devx.ci.check_pr_size --base origin/master --head HEAD
-
-# See which roles need fast molecule
-python -m devx.ci.fast_molecule --base origin/master --head HEAD
-
-# Check nightly gate status
-python -m devx.ci.nightly_gate --repo oblachno/infra --action check
-```

.devin/skills/testing-and-debugging/SKILL.md

@@ -35,12 +35,6 @@ produces false failures (missing dependencies, wrong Python version).
 | All platforms | `make molecule-all` | All 6 scenarios on all 4 OSes |
 | Parallel | `make molecule-all-parallel` | MOLECULE_JOBS=4 |
 
-### Spec-Driven Workflow
-
-Every PR requires a spec file at `docs/specs/<TASK-ID>.md`. See the
-`spec-driven-development` skill for the full workflow and template.
-CI validates the spec before running expensive jobs.
-
 ## Pre-Push Verification
 
 **Before pushing any branch:**

.gitea/actions/notify-failure/action.yml

@@ -0,0 +1,47 @@
+name: 'Notify on failure'
+description: 'Create a Gitea issue when a CI workflow fails (calls devx.ci.notify_failure)'
+
+# Composite action for the common "Notify on failure" step pattern.
+# Replaces the repeated inline:
+#   - name: Notify on failure
+#     if: failure()
+#     env:
+#       CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+#     run: |
+#       . .venv/bin/activate 2>/dev/null || true
+#       export PATH="$HOME/.local/bin:$PATH"
+#       python3 -m devx.ci.notify_failure \
+#         --repo "${{ github.repository }}" \
+#         --run-id "${{ github.run_id }}" \
+#         --workflow "ci/validate" \
+#         --commit "${{ github.sha }}" \
+#         --auto-login
+#
+# Gitea 1.27 notes:
+# - `if: failure()` is evaluated in the calling workflow's context and
+#   propagates correctly to composite action steps.
+# - `secrets` are not accessible here; the calling workflow's top-level
+#   `env:` CI_GITEA_API_TOKEN is used via `${{ env.* }}`.
+
+inputs:
+  workflow:
+    description: 'Workflow/job name used in the Gitea issue title (e.g., ci/validate)'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Notify on failure
+      if: failure()
+      shell: bash
+      env:
+        CI_GITEA_API_TOKEN: ${{ env.CI_GITEA_API_TOKEN }}
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        export PATH="$HOME/.local/bin:$PATH"
+        python3 -m devx.ci.notify_failure \
+          --repo "${{ github.repository }}" \
+          --run-id "${{ github.run_id }}" \
+          --workflow "${{ inputs.workflow }}" \
+          --commit "${{ github.sha }}" \
+          --auto-login

.gitea/actions/quality-checks/action.yml

@@ -0,0 +1,89 @@
+name: 'Quality checks'
+description: 'Run lint, unit tests with coverage, test speed, docs, translations, and security scan'
+
+# Composite action for the 6-step quality check sequence used by the
+# devx validate job. Replaces the inline block:
+#   - Lint all
+#   - Unit tests with 100% coverage
+#   - Check unit test speed
+#   - Documentation gate (coverage + stale refs + lint + version refs + prose)
+#   - Translation completeness check
+#   - Dependency security scan
+#
+# Each step activates the venv defensively (`. .venv/bin/activate 2>/dev/null
+# || true`) so the action works whether or not the setup step created a
+# venv at the repo root (pre-built CI images symlink /opt/venv to .venv).
+#
+# Gitea 1.27 notes:
+# - Every `run` step needs explicit `shell:`.
+# - Inputs are string-typed; numeric thresholds are passed through as
+#   strings to `devx.tools.check_test_speed`.
+
+inputs:
+  package:
+    description: 'Package name for doc version checks (e.g., devx, grm). Empty = no DEVX_DOC_VERSIONS_PKG override.'
+    required: false
+    default: ''
+  test-speed-max:
+    description: 'Max total test seconds (passed to check_test_speed --max-seconds)'
+    required: false
+    default: '15'
+  test-speed-max-single:
+    description: 'Max single test seconds (passed to check_test_speed --max-single-seconds)'
+    required: false
+    default: '0.5'
+  translations-file:
+    description: 'Path to translations.json (empty = default location src/devx/translations.json)'
+    required: false
+    default: ''
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Lint all
+      shell: bash
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        export PATH="$HOME/.local/bin:$PATH"
+        make lint-all
+    - name: Unit tests with 100% coverage
+      shell: bash
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        make pytest-cov
+    - name: Check unit test speed
+      shell: bash
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        python3 -m devx.tools.check_test_speed \
+          --max-seconds "${{ inputs.test-speed-max }}" \
+          --max-single-seconds "${{ inputs.test-speed-max-single }}"
+    - name: Documentation gate (coverage + stale refs + lint + version refs + prose)
+      shell: bash
+      env:
+        DEVX_DOC_COVERAGE_STRICT: "1"
+        DEVX_VALE_LEVEL: warning
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        export PATH="$HOME/.local/bin:$PATH"
+        if [ -n "${{ inputs.package }}" ]; then
+          export DEVX_DOC_VERSIONS_PKG="${{ inputs.package }}"
+        fi
+        make devx-docs-check
+    - name: Translation completeness check
+      shell: bash
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        if [ -n "${{ inputs.translations-file }}" ]; then
+          python3 -m devx.ci.check_translations --translations "${{ inputs.translations-file }}"
+        else
+          python3 -m devx.ci.check_translations
+        fi
+    - name: Dependency security scan
+      shell: bash
+      run: |
+        . .venv/bin/activate 2>/dev/null || true
+        # Install pip in venv if missing (needed by pip-audit)
+        .venv/bin/python -m ensurepip 2>/dev/null || true
+        PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
+          pip-audit --desc --skip-editable 2>&1 || true

.gitea/actions/setup-env/action.yml

@@ -0,0 +1,37 @@
+name: 'Set up environment'
+description: 'Set up CI environment with venv and PATH (calls make setup-image)'
+
+# Composite action for the common "Set up environment" step pattern.
+# Replaces the repeated inline:
+#   - name: Set up environment
+#     env:
+#       CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+#     run: make setup-image
+#
+# Gitea 1.27 notes:
+# - Every `run` step needs explicit `shell:`.
+# - Composite actions cannot access `secrets` directly; they read from
+#   the `env:` context which the calling workflow must populate.
+# - The calling workflow's top-level `env:` block (CI_GITEA_API_TOKEN,
+#   CI_GITEA_USERNAME) is visible here via `${{ env.* }}`.
+
+inputs:
+  extras:
+    description: 'Extra pip install groups passed to make setup-image (e.g., ci,lint,release)'
+    required: false
+    default: ''
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up environment
+      shell: bash
+      env:
+        CI_GITEA_API_TOKEN: ${{ env.CI_GITEA_API_TOKEN }}
+        CI_GITEA_USERNAME: ${{ env.CI_GITEA_USERNAME }}
+      run: |
+        if [ -n "${{ inputs.extras }}" ]; then
+          make setup-image EXTRAS="${{ inputs.extras }}"
+        else
+          make setup-image
+        fi

.gitea/workflows/ci.yml

@@ -18,7 +18,11 @@ jobs:
   # Saves ~5x checkout+setup overhead vs 6 separate jobs.
   validate:
     runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
+    container:
+      image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
+      credentials:
+        username: ${{ vars.CI_GITEA_USERNAME }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     defaults:
       run:
@@ -32,45 +36,14 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-        run: make setup-image EXTRAS=ci,lint
-      # --- quality steps ---
-      - name: Lint all
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          make lint-all
-      - name: Unit tests with 100% coverage
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          make pytest-cov
-      - name: Documentation gate (coverage + stale refs + lint + version refs + prose)
-        env:
-          DEVX_DOC_COVERAGE_STRICT: "1"
-          DEVX_DOC_VERSIONS_PKG: grm
-          DEVX_VALE_LEVEL: warning
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          make devx-docs-check
-      - name: Translation completeness check
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.check_translations --translations src/grm/translations.json
-      - name: Check unit test speed
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.tools.check_test_speed --max-seconds 4 --max-single-seconds 0.5
-      - name: Dependency security scan
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          # Install pip in venv if missing (needed by pip-audit)
-          .venv/bin/python -m ensurepip 2>/dev/null || true
-          PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
-            pip-audit --desc --skip-editable 2>&1 || true
+      - uses: ./.gitea/actions/setup-env
+        with:
+          extras: "ci,lint"
+      - uses: ./.gitea/actions/quality-checks
+        with:
+          package: grm
+          test-speed-max: "4"
+          translations-file: src/grm/translations.json
       - name: Workflow dry-run validation
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -110,30 +83,14 @@ jobs:
             --pr-title "$PR_TITLE" \
             --repo "$REPOSITORY" \
             --pr-number "$PR_NUMBER"
-      - name: Validate spec file
+      - name: Run automated PR review
         if: github.event_name == 'pull_request'
-        env:
-          DEVX_TASK_PREFIX: GRM
-          PYTHONPATH: ${{ env.PYTHONPATH }}
-          HEAD_REF: ${{ github.head_ref }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.validate_spec \
-            --branch "$HEAD_REF" \
-            --github-output
-      - name: Check PR size
-        if: github.event_name == 'pull_request'
-        env:
-          PYTHONPATH: ${{ env.PYTHONPATH }}
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.check_pr_size \
-            --base "origin/master" \
-            --head "${{ github.event.pull_request.head.sha || github.sha }}" \
-            --repo "${{ github.repository }}" \
-            --pr-number "${{ github.event.number }}" \
-            --github-output
+          set -euo pipefail
+          python3 -m devx.ci.pr_review \
+            "${{ github.event.number }}" \
+            "${{ github.repository }}"
       # --- release-dry-run step (conditional) ---
       - name: Release dry-run validation
         if: steps.detect.outputs.user-facing-changed == 'true'
@@ -156,24 +113,19 @@ jobs:
             --owner "${{ github.repository_owner }}" \
             --repo "${{ github.event.repository.name }}" \
             --github-output
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure --auto-login \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "ci/validate" \
-            --commit "${{ github.sha }}"
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "ci/validate"
 
   molecule-tests:
     needs: [validate]
     if: needs.validate.outputs.ansible-changed == 'true'
     runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
+    container:
+      image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
+      credentials:
+        username: ${{ vars.CI_GITEA_USERNAME }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -282,7 +234,11 @@ jobs:
       github.event_name == 'pull_request' &&
       needs.validate.result == 'success'
     runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
+    container:
+      image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
+      credentials:
+        username: ${{ vars.CI_GITEA_USERNAME }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     defaults:
       run:
@@ -292,69 +248,23 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-        run: make setup-image EXTRAS=ci
+      - uses: ./.gitea/actions/setup-env
+        with:
+          extras: "ci"
       - name: Post approval review
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
-          GITHUB_SERVER_URL: ${{ github.server_url }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
+          REPOSITORY: ${{ github.repository }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
-          # Post APPROVE review via Gitea API to satisfy branch protection
-          curl -s -X POST \
-            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" \
-            -H "Authorization: token ${REVIEWER_GITEA_API_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"event":"APPROVED","body":"Auto-approved: all CI checks passed (validate, molecule-tests)."}' \
-            || echo "::warning::Failed to post approval review (best-effort)."
-      - name: Wait for molecule tests to complete
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          # Poll commit status until all required checks pass or fail
-          MAX_WAIT=600  # 10 minutes
-          ELAPSED=0
-          while [ $ELAPSED -lt $MAX_WAIT ]; do
-            STATUS=$(curl -s -H "Authorization: token $CI_GITEA_API_TOKEN" \
-              "https://git.oblachno.oblachno.fyi/api/v1/repos/${{ github.repository }}/commits/$HEAD_SHA/status" \
-              | python3 -c "
-          import sys,json
-          d=json.load(sys.stdin)
-          statuses={s['context']:s['status'] for s in d.get('statuses',[])}
-          # Check if all molecule-tests contexts are terminal (success/failure/skipped)
-          mol_contexts=[k for k in statuses if 'molecule-tests' in k]
-          if not mol_contexts:
-              print('skipped')
-          elif all(statuses[k] in ('success','failure','skipped') for k in mol_contexts):
-              if any(statuses[k]=='failure' for k in mol_contexts):
-                  print('failure')
-              else:
-                  print('success')
-          else:
-              print('pending')
-          ")
-            echo "Molecule tests status: $STATUS (elapsed: ${ELAPSED}s)"
-            if [ "$STATUS" = "success" ] || [ "$STATUS" = "skipped" ]; then
-              echo "All molecule tests passed (or skipped — no ansible changes)."
-              break
-            elif [ "$STATUS" = "failure" ]; then
-              echo "ERROR: Molecule tests failed. Aborting auto-merge."
-              exit 1
-            fi
-            sleep 30
-            ELAPSED=$((ELAPSED + 30))
-          done
-          if [ $ELAPSED -ge $MAX_WAIT ]; then
-            echo "ERROR: Timed out waiting for molecule tests."
-            exit 1
-          fi
+          python3 -m devx.ci.pr_review \
+            "$PR_NUMBER" \
+            "$REPOSITORY" \
+            --event APPROVE \
+            --checklist-confirmed \
+            --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
+            --body "Auto-approved: all CI checks passed (validate, molecule-tests)."
       - name: Squash merge with task ID
         env:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}

.gitea/workflows/post-merge.yml

@@ -36,7 +36,11 @@ env:
 jobs:
   detect-and-configure:
     runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
+    container:
+      image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
+      credentials:
+        username: ${{ vars.CI_GITEA_USERNAME }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     defaults:
       run:
@@ -49,11 +53,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-        run: make setup-image EXTRAS=ci
+      - uses: ./.gitea/actions/setup-env
+        with:
+          extras: "ci"
       - name: Ensure branch protection and labels
         env:
           DEVX_REPO_NAME: grm
@@ -87,24 +89,19 @@ jobs:
             --base "HEAD~1" \
             --head "HEAD" \
             --github-output
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure --auto-login \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "post-merge/detect-and-configure" \
-            --commit "${{ github.sha }}"
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "post-merge/detect-and-configure"
 
   release-and-maintain:
     needs: [detect-and-configure]
     if: always() && needs.detect-and-configure.result == 'success'
     runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
+    container:
+      image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
+      credentials:
+        username: ${{ vars.CI_GITEA_USERNAME }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     outputs:
       tag: ${{ steps.release-tag.outputs.tag }}
@@ -117,20 +114,22 @@ jobs:
           fetch-depth: 0
           ref: master
           token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - name: Set up environment
+      - uses: ./.gitea/actions/setup-env
+        with:
+          extras: "ci,lint"
+      - name: Configure git
         env:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-        run: make setup-image EXTRAS=ci,lint
-      - name: Configure git
         run: |
           git config user.name "grm-ci-bot"
           git config user.email "grm-ci-bot@oblachno.fyi"
+          git remote set-url origin "https://grm-ci-bot:${CI_GITEA_API_TOKEN}@git.oblachno.oblachno.fyi/oblachno-oss/grm.git"
       # --- release + publish (only if not a release commit) ---
       - name: Run release
         id: release-tag
         if: needs.detect-and-configure.outputs.is-release == 'false' && needs.detect-and-configure.outputs.user-facing-changed == 'true'
         env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           DEVX_VERSION_FILE: src/grm/__init__.py
           DEVX_TASK_PREFIX: GRM
           DEVX_VIKUNJA_PROJECT_ID: 6
@@ -148,26 +147,6 @@ jobs:
           git fetch --tags
           git checkout "${{ steps.release-tag.outputs.tag }}"
           python3 -m devx.ci.publish "${{ steps.release-tag.outputs.tag }}" "${{ github.repository }}" --auto-login
-      - name: Create infra dependency PR
-        if: steps.release-tag.outputs.tag != ''
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
-          PYTHONPATH: ${{ env.PYTHONPATH }}
-          DEVX_TASK_PREFIX: GRM
-          DEVX_VIKUNJA_PROJECT_ID: 6
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          # Extract version from the tag (strip leading 'v')
-          TAG="${{ steps.release-tag.outputs.tag }}"
-          VERSION="${TAG#v}"
-          python3 -m devx.ci.create_dependency_pr \
-            --repo oblachno/infra \
-            --package grm \
-            --new-version "$VERSION" \
-            --source-repo "${{ github.repository }}" \
-            --source-run-id "${{ github.run_id }}" || \
-            echo "::warning::Failed to create infra dependency PR (best-effort)."
       # --- sync-wiki + vikunja (skip on automated/release commits) ---
       - name: Sync documentation to wiki
         if: needs.detect-and-configure.outputs.is-automated == 'false'
@@ -197,15 +176,6 @@ jobs:
           git fetch origin master
           git reset --hard origin/master
           python3 -m devx.ci.push_badges
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure --auto-login \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "post-merge/release-and-maintain" \
-            --commit "${{ github.sha }}"
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "post-merge/release-and-maintain"

AGENTS.md

@@ -61,37 +61,8 @@ CI also runs a best-effort `make workflow-dryrun` step (skipped if act_runner is
 - **devx package** (installed from git) — Reusable CI/CD tools: auto-merge, post-merge, release, publishing, molecule distribution, PR reviews, failure notifications
 - **Versioning** (`cliff.toml`) — git-cliff configuration for automated semver versioning from conventional commits
 
-
-## Spec-Driven Development
-
-Every change starts with a spec. No spec, no code.
-
-**Workflow:**
-1. Create Vikunja task → get `<PREFIX>-N` task ID
-2. Write spec at `docs/specs/<TASK-ID>.md` (see template in `.devin/skills/spec-driven-development/SKILL.md`)
-3. Create branch, implement with `# Implements: REQ-N` comments
-4. Tick all acceptance criteria checkboxes in spec
-5. Push and create PR — CI validates spec before expensive jobs
-
-**CI gates (pre-merge):**
-- `devx.ci.validate_spec` — checks spec exists, has required sections, REQ-IDs, all ACs checked
-- `devx.ci.check_pr_size` — max 500 lines / 10 files (excludes CHANGELOG, badges, locks)
-- `devx.ci.fast_molecule` — converge+verify only for changed roles, single platform
-
-**Nightly (infra only):**
-- Full molecule suite (all scenarios, all platforms) + staging deploy + integration tests
-- On failure: sets `NIGHTLY_STATUS=failed`, blocks staging deploys
-- Post-merge auto-deploy to staging checks this gate before deploying
-
-**Post-merge:**
-- Infra: auto-deploys to staging (if nightly gate is green)
-- GRM/sso-bridge: auto-publishes package, auto-creates infra dependency PR to bump pinned version
-
-**Skill:** `.devin/skills/spec-driven-development/SKILL.md` — full template and workflow details.
-
 ## PR Workflow (Mandatory)
 
-
 Every change to master goes through this workflow. No exceptions.
 
 ### Branch Protection (Required Gitea Settings)
@@ -147,40 +118,67 @@ docs: update README
 
 ### 6. Review the PR (Mandatory — Before Adding ready-to-merge Label)
 
-**Review checklist:** Every PR is reviewed against 8 categories covering
-functional correctness, completeness, architecture, reliability,
-robustness, security, technical excellence, and test quality.
+**Review checklist:** Every PR is reviewed against 13 categories covering
+architecture, code quality, security, i18n, testing, performance,
+UX, documentation, workflow compliance, maintainability, resource
+management, backwards compatibility, and logging.
 
-**Deep review (agent-invoked `pr-review` skill):** The agent invokes
-the `pr-review` skill to perform a deep, critical review of the PR.
-The skill posts inline comments for each issue found via the Gitea MCP,
-auto-fixes them, pushes fixes to the PR branch, resolves discussion
-threads, and posts a brief summary. When no blocking issues remain,
-the PR is marked `ready-to-merge`.
+**Automated review (CI `validate` job):** Every PR triggers an automated
+review via `python -m devx.ci.pr_review` as a step in the `validate` job.
+This posts a review with
+`COMMENT` (no issues) or `REQUEST_CHANGES` (issues found) based on
+the **[auto]** items in the checklist:
 
-See `.devin/skills/pr-review/SKILL.md` for the full review procedure,
-categories, and MCP tool reference.
+- Architecture compliance (no subprocess in CLI, no hardcoded URLs)
+- Best practices (no `print()`, no bare `except`, no `TODO`/`FIXME`,
+  no functions > 50 lines)
+- Security (no hardcoded secrets, no `shell=True`, no `eval`/`exec`)
+- i18n (no raw strings in `click.echo()` without `_()` wrapper)
+- Resource management (no `open()` without `with`, no `Popen()` without cleanup)
+- Documentation (source changes must include doc updates)
+- Test coverage (source changes must include test updates)
+- Commit conventions (conventional commit format on PR commits)
+
+The automated review posts inline comments on specific lines and
+includes a summary of the checklist categories. The agent **must** address all
+`REQUEST_CHANGES` issues before proceeding.
+
+**Manual review (agent):** After the automated review passes, the agent
+must go through **every category** listed above and verify
+the **[manual]** items by reviewing the full diff
+(`git diff master...HEAD`).
+
+Post review comments using `devx.ci.pr_review` (run as `python -m devx.ci.pr_review`):
+```bash
+CI_GITEA_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
+  --event REQUEST_CHANGES \
+  --body "Review summary"
+```
 
 ### 7. Address Review Comments
 Fix each comment one by one, commit, and push. Re-review until satisfied.
 
-### 8. Mark Ready to Merge
-Once all issues are addressed, add the `ready-to-merge` label:
+### 8. Approve and Merge
+Once all checklist items are verified and comments are addressed, post
+an approval review with `--checklist-confirmed` and `--checklist-categories`:
 ```bash
-make devx-pr-label
+CI_GITEA_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
+  --event APPROVE --checklist-confirmed \
+  --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
+  --body "All 13 checklist categories verified. Architecture: <summary>. Security: <summary>. Tests: <summary>. Docs: <summary>."
 ```
-The auto-merge workflow posts an APPROVE review via the Gitea API
-and squash-merges with title `GRM-N: <conventional commit message>`.
 
-> **IMPORTANT**: Never manually merge PRs via the API. Always use the auto-merge
-> workflow by adding the `ready-to-merge` label. Manual merges bypass the
-> `GRM-N: <conventional>` format enforcement, producing incorrectly named commits.
-> The auto-merge script validates the PR title matches the Vikunja task ID
-> and conventional commit format before merging.
+The `--checklist-confirmed` flag is **required** for APPROVE events —
+it attests that the reviewer has gone through every checklist category.
+The `--checklist-categories` flag is also **required** — it must list at
+least 8 of the 13 category numbers, ensuring the reviewer actually
+checked each category rather than rubber-stamping. The review body must
+be substantive (> 50 characters) — perfunctory approvals like "LGTM" are
+rejected.
 
-The auto-merge workflow will:
+Then add the `ready-to-merge` label. The auto-merge workflow will:
 1. **Validate** PR title format (`GRM-N: <vikunja task title>`) and match against Vikunja task title
-2. **Post** an APPROVE review via the Gitea API (to satisfy branch protection)
+2. **Check** that at least one substantive APPROVE review exists (body > 20 chars or has inline comments)
 3. Wait for all CI checks to pass (including the `validate` job)
 4. Squash-merge with title: `GRM-N: <conventional commit message>`
 5. The post-merge workflow marks the Vikunja task as done
@@ -192,6 +190,12 @@ a new CI run. The next auto-merge attempt will merge successfully.
 No manual rebase needed. To rebase manually: `make rebase` (local) or
 `make pr-rebase` (server-side via API).
 
+> **IMPORTANT**: Never manually merge PRs via the API. Always use the auto-merge
+> workflow by adding the `ready-to-merge` label. Manual merges bypass the
+> `GRM-N: <conventional>` format enforcement, producing incorrectly named commits.
+> The auto-merge script validates the PR title matches the Vikunja task ID
+> and conventional commit format before merging.
+
 ### CI Path Filtering
 
 The CI workflow's `validate` job includes a pre-merge validation step
@@ -274,7 +278,7 @@ via `[tool.devx.classify]` in `pyproject.toml`.
 - Any new file type not in the allowlist
 
 **devx module structure** (installed from git, not in this repo):
-- `devx.ci.*` — CI/CD automation (run by workflows): release, publish, auto_merge, classify_changes, detect_release_commit, push_badges, doc_coverage, sync_wiki, distribute_molecule, discover_runners, notify_failure, post_merge, validate_commit_msg
+- `devx.ci.*` — CI/CD automation (run by workflows): release, publish, auto_merge, classify_changes, detect_release_commit, push_badges, doc_coverage, sync_wiki, distribute_molecule, discover_runners, notify_failure, post_merge, pr_review, validate_commit_msg
 - `devx.tools.*` — Dev tools (run locally): check_test_speed, configure_repo, install_checkmake, install_tools, setup, generate_badges, create_task, create_pr, pr_status, pr_logs, pr_label, rebase, pr_rebase
 - `devx.molecule.*` — Molecule helpers: molecule_all, platforms, discover_runners, distribute_molecule
 - `devx.gitea_cli` — Tea CLI wrapper
@@ -330,10 +334,12 @@ The `tea` Gitea CLI tool is used for Gitea API interactions in devx. It is insta
 - `devx.tools.configure_repo` — Creates labels via `tea labels create` (falls back to `GiteaClient` if tea fails; branch protection still uses `GiteaClient` since tea only supports basic protect/unprotect)
 
 **Operations still using `GiteaClient` (not supported by tea):**
+- PR reviews (`devx.ci.pr_review`) — tea v0.14.1 only supports interactive reviews
 - Wiki page management (`devx.ci.sync_wiki`)
 - Commit status checks (`devx.ci.auto_merge`)
 - Runner discovery (`devx.molecule.discover_runners`)
 - Branch protection with detailed config (`devx.tools.configure_repo`)
+- PR file/commit listing (`devx.ci.pr_review`)
 
 ### PYTHONPATH Configuration
 
@@ -341,7 +347,7 @@ Since devx is installed as a package (via `pip install` from git), it is importa
 
 | PYTHONPATH | When to use | Example modules |
 |------------|-------------|-----------------|
-| `src` | Module imports from `grm` | `devx.ci.auto_merge`, `devx.ci.sync_wiki`, `devx.ci.post_merge`, `devx.ci.classify_changes`, `devx.molecule.discover_runners`, `devx.ci.doc_coverage` |
+| `src` | Module imports from `grm` | `devx.ci.auto_merge`, `devx.ci.pr_review`, `devx.ci.pr_review`, `devx.ci.sync_wiki`, `devx.ci.post_merge`, `devx.ci.classify_changes`, `devx.molecule.discover_runners`, `devx.ci.doc_coverage` |
 | (none) | Module has no GRM imports | `devx.ci.detect_release_commit`, `devx.molecule.distribute_molecule`, `devx.ci.push_badges`, `devx.ci.validate_commit_msg` |
 
 **In workflows**, always use `env:` blocks (not inline `PYTHONPATH=value`):

CHANGELOG.md

@@ -2,23 +2,29 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.22.0] - 2026-08-25
+## [Unreleased]
 
-### Features
+### CI
 
-- Adopt spec-driven CI gates, create_dependency_pr, and pr-review skill
-
-## [0.21.1] - 2026-08-24
+- Convert `ci.yml` and `post-merge.yml` to use composite actions
+  (`setup-env`, `quality-checks`, `notify-failure`) copied from devx,
+  reducing workflow duplication
 
 ### Bug Fixes
 
-- Use runuser for systemctl --user tasks in gitea_runner role
+- Fix `register.yml` premature service start: removed step that ran
+  `systemctl --user start gitea-runner` before the systemd unit file was
+  created by `service.yml` (included after `register.yml`). First-time
+  installs were failing with "Unit gitea-runner.service not found".
+- Fix `ci.yml` auto-merge IndentationError: replaced broken inline Python
+  polling script with `devx.ci.wait_for_checks` (the inline Python had
+  YAML run-block indentation leaking into `python3 -c` string).
 
-## [0.21.0] - 2026-08-09
+### Dependencies
 
-### Features
-
-- *(healthcheck)* Add two-tier disk prune with critical threshold
+- Bump devx from v0.50.0 to v0.50.5 (adds `wait_for_checks` tool,
+  consolidated Ansible checks, tenacity retry in `install_tools`,
+  increased download retry attempts/backoff)
 
 ## [0.20.0] - 2026-08-09
 

README.md

@@ -8,12 +8,12 @@ Each runner runs in an isolated **rootless Docker** environment under a dedicate
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/python.svg)](https://www.python.org/downloads/)
 
 ## Why GRM?
 

ansible/roles/gitea_runner/defaults/main.yml

@@ -36,9 +36,10 @@ gitea_runner_prune_label: "gitea-runner=true"
 gitea_runner_service_restart_sec: "5"
 
 # Health check configuration
-# 2min interval — catches hung daemons before multiple CI jobs fail between checks.
-# The previous 5min interval was too coarse: a stuck daemon could fail 3+ molecule
-# jobs in the window between healthcheck runs.
+# 2min interval — catches hung daemons before multiple CI jobs fail between
+# checks. The 1min interval caused excessive pruning which removed cached
+# images, forcing all 6 parallel slots to re-pull simultaneously and
+# actually increasing disk pressure.
 gitea_runner_healthcheck_interval: "2min"
 gitea_runner_healthcheck_boot_delay: "2min"
 gitea_runner_healthcheck_disk_threshold: 70
@@ -47,6 +48,10 @@ gitea_runner_healthcheck_disk_threshold: 70
 # This removes all stopped containers and unused images regardless of age.
 # At 75%+, molecule containers fail with "container is not running" because
 # overlay2 runs out of space under parallel DinD load.
+# IMPORTANT: keep at 75 (not lower) — the host disk normally sits at ~74%.
+# Lowering to 70 triggers full prune every cycle, wiping cached images and
+# forcing all parallel slots to re-pull simultaneously, which increases
+# disk pressure rather than reducing it.
 gitea_runner_healthcheck_disk_critical: 75
 gitea_runner_healthcheck_script_path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
 
@@ -76,6 +81,10 @@ gitea_runner_docker_shutdown_timeout: 30
 gitea_runner_docker_max_concurrent_downloads: 3
 gitea_runner_docker_max_concurrent_uploads: 3
 gitea_runner_docker_default_nofile: 65536
+# Log file size limits — under parallel DinD load, container logs can fill
+# disk and cause the daemon to become unresponsive. Limit log size per container.
+gitea_runner_docker_max_log_size: "10m"
+gitea_runner_docker_max_log_files: 3
 
 # Admin token for runner deregistration via Gitea API.
 # If not set, falls back to registration_token (which likely lacks admin scope).

ansible/roles/gitea_runner/handlers/main.yml

@@ -10,3 +10,7 @@
     - ansible_facts is defined
     - ansible_facts['service_mgr'] | default('') == 'systemd'
     - gitea_runner_docker_rootless_setup
+
+- name: Reload systemd user daemon
+  ansible.builtin.systemd:
+    daemon_reload: true

ansible/roles/gitea_runner/molecule/template-content/verify.yml

@@ -112,5 +112,4 @@
           - "'status=removing' in healthcheck_script.content | b64decode"
           - "'status=stopping' in healthcheck_script.content | b64decode"
           - "gitea_runner_healthcheck_disk_threshold | string in healthcheck_script.content | b64decode"
-          - "gitea_runner_healthcheck_disk_critical | string in healthcheck_script.content | b64decode"
         fail_msg: "Healthcheck script template is missing expected content"

ansible/roles/gitea_runner/tasks/register.yml

@@ -44,10 +44,6 @@
     ('already exists' not in gitea_runner_register_output.stdout | default(''))
   timeout: 60
 
-# Note: service start is handled by service.yml (included after register.yml
-# in install_runner.yml). Starting here fails because the systemd unit file
-# has not been created yet.
-
 - name: Restart runner service after (re-)registration
   ansible.builtin.command: >
     runuser -u {{ gitea_runner_service_user }} --

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -184,6 +184,10 @@
         "features": {
           "containerd-snapshotter": false
         },
+        "log-opts": {
+          "max-size": "{{ gitea_runner_docker_max_log_size }}",
+          "max-file": "{{ gitea_runner_docker_max_log_files }}"
+        },
         {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
         "ipv6": true,
         "ip6tables": true,
@@ -288,6 +292,10 @@
         "features": {
           "containerd-snapshotter": false
         },
+        "log-opts": {
+          "max-size": "{{ gitea_runner_docker_max_log_size }}",
+          "max-file": "{{ gitea_runner_docker_max_log_files }}"
+        },
         {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
         "ipv6": true,
         "ip6tables": true,

ansible/roles/gitea_runner/tasks/user_setup.yml

@@ -69,3 +69,31 @@
     owner: "{{ gitea_runner_service_user }}"
     group: "{{ gitea_runner_service_user }}"
     mode: "0755"
+
+- name: Disable systemd-oomd memory pressure kill for runner user
+  when: gitea_runner_systemd_available.stat.exists
+  block:
+    - name: Ensure user service override directory exists
+      ansible.builtin.file:
+        path: "/etc/systemd/system/user@{{ gitea_runner_uid }}.service.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Disable ManagedOOMMemoryPressure for runner user
+      ansible.builtin.copy:
+        content: |
+          [Service]
+          ManagedOOMMemoryPressure=auto
+          ManagedOOMMemoryPressureLimit=100%
+          OOMScoreAdjust=-500
+        dest: "/etc/systemd/system/user@{{ gitea_runner_uid }}.service.d/oomd-override.conf"
+        owner: root
+        group: root
+        mode: "0644"
+      notify: Reload systemd user daemon
+
+    - name: Reload systemd daemon for oomd override
+      ansible.builtin.systemd:
+        daemon_reload: true

ansible/roles/gitea_runner/templates/docker-prune.service.j2

@@ -11,13 +11,7 @@ Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
 # consuming disk and memory. We stop+rm everything first, then prune the rest.
 # Exclude CI job containers (name starts with GITEA-ACTIONS-TASK) — removing
 # them kills the active CI job and causes "RWLayer is unexpectedly nil" errors.
-# Only remove containers older than 1 hour (grep for "hour/day/week/month/year
-# ago" in RunningFor) to avoid killing molecule test containers that CI jobs
-# are actively using.
-ExecStart=/bin/sh -c 'docker ps -a --format "{% raw %}{{.ID}} {{.Names}} {{.RunningFor}}{% endraw %}" 2>/dev/null | grep -v "GITEA-ACTIONS-TASK" | grep -E "(hour|day|week|month|year)s? ago" | awk "{print $1}" | xargs -r docker rm -f 2>/dev/null || true'
+ExecStart=/bin/sh -c 'docker ps -a --format "{% raw %}{{.ID}} {{.Names}}{% endraw %}" 2>/dev/null | grep -v "GITEA-ACTIONS-TASK" | awk "{print $1}" | xargs -r docker rm -f 2>/dev/null || true'
 ExecStart=/usr/bin/docker system prune -af --filter "until={{ gitea_runner_prune_until }}" --volumes
-# Prune networks older than the prune-until threshold to avoid removing
-# networks that molecule tests are actively creating (e.g. 'traefik' network
-# created during molecule create phase before containers are attached).
-ExecStart=/usr/bin/docker network prune -f --filter "until={{ gitea_runner_prune_until }}"
+ExecStart=/usr/bin/docker network prune -f
 ExecStart=/usr/bin/docker builder prune -f

ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2

@@ -48,14 +48,6 @@ fi
 # runner (e.g., server restore, runner record deleted, Gitea restart with
 # token salt change), the runner logs "unregistered runner" every few seconds.
 # A service restart will not fix this; re-registration is required.
-#
-# Detection method: query the Gitea API to verify the runner's UUID still
-# exists.  This is more reliable than parsing journal logs (which requires
-# journal access permissions that runner users may not have — see the
-# 2026-08-08 incident where journalctl --user returned "No journal files
-# were opened due to insufficient permissions" for all runner users,
-# causing the healthcheck to always report "OK: runner healthy" even
-# though all runners were unregistered).
 {% if gitea_runner_auto_recover_api_token %}
 # Auto-recovery is enabled: fetch a new registration token from the Gitea API
 # and re-register the runner automatically. A cooldown prevents infinite loops.
@@ -66,50 +58,10 @@ GITEA_URL="{{ gitea_url }}"
 RUNNER_NAME="{{ gitea_runner_name }}"
 RUNNER_LABELS="{{ gitea_runner_labels }}"
 BINARY="{{ gitea_runner_binary_path }}"
-RUNNER_FILE="{{ gitea_runner_data_dir }}/.runner"
 {% endif %}
-runner_unregistered=0
-
-# Primary detection: query the Gitea API to check if the runner's ID
-# still exists in Gitea's runner list.  This works regardless of journal
-# permissions.
-{% if gitea_runner_auto_recover_api_token %}
-if [[ -f "$GITEA_API_TOKEN_FILE" && -f "$RUNNER_FILE" ]]; then
-    API_TOKEN=$(cat "$GITEA_API_TOKEN_FILE" 2>/dev/null || true)
-    RUNNER_ID=$(python3 -c "import json; print(json.load(open('$RUNNER_FILE')).get('id',''))" 2>/dev/null || true)
-    if [[ -n "$API_TOKEN" && -n "$RUNNER_ID" ]]; then
-        # List all runners and check if our ID is present
-        runner_found=$(curl -sf --connect-timeout 5 --max-time 10 \
-            -H "Authorization: token $API_TOKEN" \
-            "${GITEA_URL}/api/v1/admin/actions/runners" 2>/dev/null \
-            | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    runners = data if isinstance(data, list) else data.get('runners', [])
-    ids = [str(r.get('id', '')) for r in runners]
-    print('1' if '$RUNNER_ID' in ids else '0')
-except Exception:
-    print('0')
-" 2>/dev/null || echo "0")
-        if [[ "$runner_found" != "1" ]]; then
-            runner_unregistered=1
-            echo "CRITICAL: runner ID $RUNNER_ID not found in Gitea (unregistered)."
-        fi
-    fi
-fi
-{% endif %}
-
-# Fallback detection: check journal logs (if accessible)
-if [[ "$runner_unregistered" -eq 0 ]]; then
-    recent_errors=$(journalctl --user -u gitea-runner.service --since "5 minutes ago" --no-pager -q 2>/dev/null | grep -c "unregistered runner" || true)
-    if [[ "$recent_errors" -ge 3 ]]; then
-        runner_unregistered=1
-        echo "CRITICAL: runner is unregistered in Gitea (re-login failed $recent_errors times in 5 minutes)."
-    fi
-fi
-
-if [[ "$runner_unregistered" -ge 1 ]]; then
+recent_errors=$(journalctl --user -u gitea-runner.service --since "5 minutes ago" --no-pager -q 2>/dev/null | grep -c "unregistered runner" || true)
+if [[ "$recent_errors" -ge 3 ]]; then
+    echo "CRITICAL: runner is unregistered in Gitea (re-login failed $recent_errors times in 5 minutes)."
 {% if gitea_runner_auto_recover_api_token %}
     # Check cooldown — skip if we recently attempted recovery
     if [[ -f "$COOLDOWN_FILE" ]]; then
@@ -183,32 +135,14 @@ if [[ "$runner_unregistered" -ge 1 ]]; then
     systemctl --user start gitea-runner.service
     sleep 3
 
-    # Verify recovery — query the Gitea API to confirm the new ID is registered
-    NEW_ID=$(python3 -c "import json; print(json.load(open('$RUNNER_FILE')).get('id',''))" 2>/dev/null || true)
-    if [[ -n "$NEW_ID" ]]; then
-        new_found=$(curl -sf --connect-timeout 5 --max-time 10 \
-            -H "Authorization: token $API_TOKEN" \
-            "${GITEA_URL}/api/v1/admin/actions/runners" 2>/dev/null \
-            | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    runners = data if isinstance(data, list) else data.get('runners', [])
-    ids = [str(r.get('id', '')) for r in runners]
-    print('1' if '$NEW_ID' in ids else '0')
-except Exception:
-    print('0')
-" 2>/dev/null || echo "0")
-        if [[ "$new_found" == "1" ]]; then
-            echo "OK: runner recovered and registered with new ID $NEW_ID"
-            # Clear cooldown on success
-            rm -f "$COOLDOWN_FILE" 2>/dev/null || true
-        else
-            echo "WARN: runner re-registered but ID not found in Gitea API. Will retry after cooldown."
-            exit 3
-        fi
+    # Verify recovery — check if unregistered errors stopped
+    new_errors=$(journalctl --user -u gitea-runner.service --since "10 seconds ago" --no-pager -q 2>/dev/null | grep -c "unregistered runner" || true)
+    if [[ "$new_errors" -eq 0 ]]; then
+        echo "OK: runner recovered and no longer reporting unregistered errors"
+        # Clear cooldown on success
+        rm -f "$COOLDOWN_FILE" 2>/dev/null || true
     else
-        echo "WARN: could not read new .runner file after re-registration. Will retry after cooldown."
+        echo "WARN: runner still showing unregistered errors after re-registration. Will retry after cooldown."
         exit 3
     fi
 {% else %}
@@ -223,43 +157,18 @@ fi
 
 # 3. Check disk space — prune aggressively if below threshold
 disk_pct=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
-if [[ "$disk_pct" -ge {{ gitea_runner_healthcheck_disk_critical }} ]]; then
-    echo "CRITICAL: Disk usage at ${disk_pct}% (>= {{ gitea_runner_healthcheck_disk_critical }}%), full prune"
-    # Critical level: remove ALL stopped containers (no age filter) and ALL
-    # unused images/volumes. The until=1h gentle prune is insufficient here.
-    # Stop+rm stale non-CI containers regardless of age (failed molecule tests
-    # from the last 59 minutes also consume disk).
+if [[ "$disk_pct" -ge {{ gitea_runner_healthcheck_disk_threshold }} ]]; then
+    echo "WARN: Disk usage at ${disk_pct}%, pruning all runner resources"
+    # Force-remove stale containers (including running ones from failed molecule tests).
+    # "docker container prune -f" only removes stopped containers, so running
+    # containers from crashed CI jobs accumulate and consume disk/memory.
+    # Exclude CI job containers (name starts with GITEA-ACTIONS-TASK).
     docker ps -a --format '{% raw %}{{.ID}} {{.Names}}{% endraw %}' 2>/dev/null \
         | grep -v 'GITEA-ACTIONS-TASK' \
         | awk '{print $1}' \
         | xargs -r docker rm -f 2>/dev/null || true
-    docker system prune -af --volumes || true
+    docker system prune -af --filter "until=1h" --volumes || true
     docker network prune -f || true
-    docker builder prune -af || true
-    disk_pct=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
-    echo "INFO: Disk usage after full prune: ${disk_pct}%"
-elif [[ "$disk_pct" -ge {{ gitea_runner_healthcheck_disk_threshold }} ]]; then
-    echo "WARN: Disk usage at ${disk_pct}%, pruning runner resources (until=1h)"
-    # Force-remove stale containers (including running ones from failed molecule tests)
-    # that are older than 1 hour. "docker container prune -f" only removes stopped
-    # containers, so running containers from crashed CI jobs accumulate and consume
-    # disk/memory. Exclude CI job containers (name starts with GITEA-ACTIONS-TASK).
-    # Only remove containers older than 1 hour to avoid killing molecule test
-    # containers that CI jobs are actively using.
-    docker ps -a --format '{% raw %}{{.ID}} {{.Names}} {{.RunningFor}}{% endraw %}' 2>/dev/null \
-        | grep -v 'GITEA-ACTIONS-TASK' \
-        | grep -E '(hour|day|week|month|year)s? ago' \
-        | awk '{print $1}' \
-        | xargs -r docker rm -f 2>/dev/null || true
-    # Prune images and containers older than 1h (until filter is NOT
-    # supported with --volumes, so prune volumes separately without a filter).
-    docker image prune -af --filter "until=1h" 2>/dev/null || true
-    docker container prune -f --filter "until=1h" 2>/dev/null || true
-    docker volume prune -f 2>/dev/null || true
-    # Prune networks older than 1 hour to avoid removing networks that
-    # molecule tests are actively creating (e.g. 'traefik' network created
-    # during molecule create phase before containers are attached).
-    docker network prune -f --filter "until=1h" || true
     disk_pct=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
     echo "INFO: Disk usage after prune: ${disk_pct}%"
 fi

docs/index.md

@@ -8,12 +8,12 @@ Each runner runs in an isolated **rootless Docker** environment under a dedicate
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/1dce72646257a35fb839f71ab5b52bb72080db6b/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/grm/raw/commit/e96a599d8e0a5186cd72bebaddbd24b2df2e2058/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 

docs/specs/GRM-165.md

@@ -1,34 +0,0 @@
-# GRM-165: Adopt spec-driven CI gates and pr-review skill
-
-## Problem
-grm uses the old `devx.ci.pr_review` CI step and lacks the new spec-driven
-CI gates (validate_spec, check_pr_size). It also needs a create_dependency_pr
-step in post-merge to auto-create infra PRs when grm publishes a new version.
-
-## Approach
-Replace pr_review CI steps with validate_spec + check_pr_size + curl-based
-APPROVE. Add create_dependency_pr step to post-merge. Add the spec-driven-
-development and pr-review skills. Update AGENTS.md.
-
-REQ-1: Replace pr_review CI steps with validate_spec + check_pr_size + curl-based APPROVE
-REQ-2: Add create_dependency_pr step to post-merge for auto-creating infra PR to bump grm version
-REQ-3: Add spec-driven-development and pr-review skills under `.devin/skills/`
-REQ-4: Update AGENTS.md to document spec-driven development workflow and pr-review skill
-
-## Test Plan
-- Verify CI workflow YAML passes actionlint
-- Verify post-merge.yml includes create_dependency_pr step with correct DEVX_TASK_PREFIX (GRM)
-- Verify validate_spec and check_pr_size steps reference correct DEVX_TASK_PREFIX (GRM)
-
-## Deploy Plan
-- Merge to master via auto-merge workflow
-- Post-merge workflow handles release + publish + dependency PR automatically
-
-## Rollback Plan
-- Revert the merge commit; CI reverts to pr_review-based workflow
-
-## Acceptance Criteria
-- [x] REQ-1: CI workflow uses validate_spec + check_pr_size + curl APPROVE instead of pr_review
-- [x] REQ-2: post-merge.yml includes create_dependency_pr step targeting oblachno/infra with package grm
-- [x] REQ-3: `.devin/skills/spec-driven-development/SKILL.md` and `.devin/skills/pr-review/SKILL.md` exist
-- [x] REQ-4: AGENTS.md documents spec-driven development workflow and pr-review skill

pyproject.toml

@@ -36,7 +36,7 @@ ci = [
     "build==1.5.1",
     "twine==6.2.0",
     # Reusable CI/CD and dev tools (auto-merge, pr-review, pre-push checks, etc.)
-    "devx @ git+https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git@v0.50.2",
+    "devx @ git+https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git@v0.50.1",
 ]
 # Lint and type-checking tools (validate job)
 lint = [
@@ -56,7 +56,7 @@ molecule = [
 dev = [
     "grm[ci,lint,molecule]",
     # Reusable CI/CD and dev tools (pre-push hooks, create-task, create-pr)
-    "devx @ git+https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git@v0.50.2",
+    "devx @ git+https://git.oblachno.oblachno.fyi/oblachno-oss/devx.git@v0.50.1",
     # Non-Python dev dependency: checkmake (Makefile linter)
     # Install via: go install github.com/checkmake/checkmake/cmd/checkmake@latest
 ]

src/grm/__init__.py

@@ -1,3 +1,3 @@
 """Gitea Runner Manager — lean CLI for managing Gitea Actions runners."""
 
-__version__ = "0.22.0"
+__version__ = "0.20.0"