AppForge v1.0: rescue the stranded publication series + fix the three v1.0 follow-ups

[adbarc92]

⚠️ Read this first: the publication work never reached main

A merge-order accident stranded five commits. PR #8 (feat/engine-plan-d-web-bridge → main) was merged at 17:20:39; PR #9 (publication-prep → feat/engine-plan-d-web-bridge) was merged at 17:20:49, ten seconds later. PR #9's content therefore landed on a branch that had already been merged into main.

Nothing from the publication series is in main today — not even the README rewrite and MIT LICENSE from #9's original scope:

$ git merge-base --is-ancestor 26c806e origin/main   # README + LICENSE -> NO
$ git merge-base --is-ancestor ba82ca8 origin/main   # v1.0 status doc  -> NO

This PR targets main directly, so merging it recovers the whole series and adds the follow-up fixes. No commits are lost and nothing needs re-doing by hand.

Carried commits: 26c806e (README + LICENSE) · ee758b6 (rename + v1.0.0) · 5a68448 (status doc + badges) · ba82ca8 (badge link) · 8509f6a (#9 merge) · 8916fbc (the fixes below).

---

What was already reviewed in #9

• Evidence-based README — MCP state server, six-phase DAG, independent workers, gates, budget downgrade; every headline claim links to a real test plus the committed run in docs/runs/2026-07-24/.
• MIT LICENSE — the repo declared MIT but had no file.
• Rename DevTeam.AI → AppForge across package metadata, prompts, config/*.yaml, agents, tests, CI, phase briefs, and the UI; placeholder your-repo URLs → the real repository. docs/superpowers/{plans,specs} deliberately untouched — dated records that quote code verbatim.
• v1.0.0 — pyproject 0.1.0 → 1.0.0, classifier Alpha → Production/Stable, frontend/package.json 0.0.0 → 1.0.0.
• docs/STATUS.md — new canonical living status doc superseding the dated Status-*.md snapshots, which still described the retired LangGraph orchestrator.
• Badges, a Configuration table for the env vars backend/config.py actually reads, a CLI flag table, and a rebuilt architecture diagram (its box borders ran 41/42/43 chars on three different lines).

New in this PR — the three follow-ups

1. The appforge CLI now actually exists

[project.scripts] appforge was declared but never installed — with no [build-system], uv skips entry points entirely. Added a hatchling build backend packaging backend/:

$ uv run appforge run "Build a tiny note-taking app" --workers 2
run 135de6da…: done
  clarify   complete  gate=approved
  code      complete  gate=none
  deploy    complete  gate=none
  design    complete  gate=approved
  iterate   complete  gate=none
  test      complete  gate=none

2. Dependencies corrected — not merely trimmed

My note on #9 said the LangChain deps were "left over from the retired orchestrator". That was wrong, and the correction matters:

Package	Reality	Action
langchain-core	Imported directly by clarifying_pm, solution_architect, tech_lead, uiux_designer — but only present transitively	Added as a direct dependency
langchain-anthropic	Instantiated lazily as ChatAnthropic by those four agents	Kept
langchain-community	Imported only by four test files (FakeListChatModel)	Moved to the dev group
langchain (meta)	Imported nowhere	Dropped
langchain-openai	Imported nowhere	Dropped

Removing all LangChain deps — what my earlier note implied — would have broken real-agent mode and four test files.

Also dropped the stale crewai / mem0ai / streamlit mypy overrides and replaced the langchain / crewai keywords with ones describing what this is (mcp, model-context-protocol, multi-agent, orchestration).

3. ENABLE_PHASE4 removed

backend/config.py read it into Config.enable_phase4 and tests/unit/test_config.py asserted its default, but nothing branched on it — a no-op knob, the same shape as the SQLITE_PATH config dropped in cde5ab7. Removed from config, tests, and e2e/playwright.config.ts, which also still set that already-dead SQLITE_PATH. Both values were inert, so the e2e harness behaves identically.

Docs kept in step

README CLI section and diagram now show appforge run "<idea>" (geometry re-verified: box rectangular at cols 8/51, entry arrows under their rules at 24/46, worker stems aligned at 15/29/43). Test count 154 → 152 across badge, README, and docs/STATUS.md — the two removed tests only covered the deleted flag.

Verification

Check	Result
uv run pytest tests/	152 passed
coverage	86.93% (gate 70%)
cd frontend && npm test	28 passed
cd frontend && npm run build	succeeds
uv run ruff check backend/ tests/	clean
uv run black --check backend/ tests/	clean, 66 files
uv sync --frozen --group dev	lock consistent, 100 packages
uv run appforge run … --workers 2	all six phases complete, exit 0
README links	all resolve; no stale 154 references

CI note: the e2e and validate-config jobs run plain uv sync (no dev group). They need only langchain-core / langchain-anthropic, both still main dependencies, so moving langchain-community to dev does not affect them.

Found, not fixed

A CancelledError traceback prints on CLI teardown when the state-server task is cancelled. Pre-existing (this PR touches no engine code) and cosmetic — the run reports done and exits 0 — but noisy. Logged in docs/STATUS.md as a known gap and next step.

After merge

The v1.0.0 tag is still held locally at ba82ca8. Because this stack uses merge commits, that commit becomes reachable from main once this lands, so the tag can be pushed as-is — or moved to the merge commit if you'd rather v1.0.0 include the follow-up fixes.