codeframe-ai 0.9.0__tar.gz → 0.9.2__tar.gz

{codeframe_ai-0.9.0 → codeframe_ai-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeframe-ai
-Version: 0.9.0
+Version: 0.9.2
 Summary: A project delivery system that orchestrates frontier coding agents: Think, Build, Prove, Ship.
 Author-email: Frank Bria <hello@codeframe.sh>
 License: AGPL-3.0-or-later
@@ -18,24 +18,24 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: anthropic>=0.18.0
+Requires-Dist: bandit>=1.8.6
 Requires-Dist: tenacity>=8.2.0
-Requires-Dist: claude-agent-sdk>=0.1.10
 Requires-Dist: openai>=1.12.0
 Requires-Dist: fastapi>=0.109.0
 Requires-Dist: uvicorn[standard]>=0.27.0
 Requires-Dist: websockets>=12.0
 Requires-Dist: pydantic>=2.6.0
 Requires-Dist: pydantic-settings>=2.1.0
-Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: sqlalchemy>=2.0.0
 Requires-Dist: aiosqlite>=0.19.0
-Requires-Dist: aiohttp>=3.9.0
+Requires-Dist: aiohttp>=3.14.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: typer>=0.9.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: textual>=0.86.0
-Requires-Dist: requests>=2.31.0
-Requires-Dist: gitpython>=3.1.40
+Requires-Dist: requests>=2.33.0
+Requires-Dist: gitpython>=3.1.50
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: tree-sitter>=0.20.4
 Requires-Dist: tree-sitter-python>=0.20.4
@@ -49,12 +49,21 @@ Requires-Dist: pytest-asyncio>=1.2.0
 Requires-Dist: pytest-json-report>=1.5.0
 Requires-Dist: hypothesis>=6.148.0
 Requires-Dist: fastapi-users[sqlalchemy]>=15.0.2
+Requires-Dist: filelock>=3.0
 Requires-Dist: python-jose[cryptography]>=3.4.0
 Requires-Dist: passlib[argon2]>=1.7.4
 Requires-Dist: keyring>=24.0.0
 Requires-Dist: jinja2>=3.1.6
 Requires-Dist: slowapi>=0.1.9
 Requires-Dist: rapidfuzz>=3.0.0
+Requires-Dist: starlette>=1.0.1
+Requires-Dist: python-multipart>=0.0.27
+Requires-Dist: pyjwt>=2.12.0
+Requires-Dist: cryptography>=46.0.7
+Requires-Dist: urllib3>=2.7.0
+Requires-Dist: pyasn1>=0.6.3
+Requires-Dist: mcp>=1.23.0
+Requires-Dist: idna>=3.15
 Provides-Extra: cloud
 Requires-Dist: e2b>=2.0.0; extra == "cloud"
 Provides-Extra: dev
@@ -63,28 +72,29 @@ Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
 Requires-Dist: pytest-json-report>=1.5.0; extra == "dev"
 Requires-Dist: pytest-timeout>=2.3.0; extra == "dev"
-Requires-Dist: black>=24.1.0; extra == "dev"
+Requires-Dist: black>=26.3.1; extra == "dev"
 Requires-Dist: ruff>=0.2.0; extra == "dev"
 Requires-Dist: mypy>=1.8.0; extra == "dev"
 Requires-Dist: pre-commit>=3.5.0; extra == "dev"
 Requires-Dist: hypothesis>=6.0.0; extra == "dev"
 Requires-Dist: e2b>=2.0.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0.0; extra == "dev"
 Dynamic: license-file
 
 ![CodeFRAME Header](./codeframe_github_header_1600x500.png)
 
-# CodeFRAME
+# CodeFRAME™
 
 ![Status](https://img.shields.io/badge/status-beta-orange)
 [![PyPI](https://img.shields.io/pypi/v/codeframe-ai)](https://pypi.org/project/codeframe-ai/)
 ![License](https://img.shields.io/badge/license-AGPL--3.0-blue)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
 [![CI](https://github.com/frankbria/codeframe/actions/workflows/test.yml/badge.svg)](https://github.com/frankbria/codeframe/actions/workflows/test.yml)
-![Coverage](https://img.shields.io/badge/coverage-88%25-brightgreen)
+![Coverage](https://img.shields.io/badge/coverage-80%25-brightgreen)
 [![Follow on X](https://img.shields.io/twitter/follow/FrankBria18044?style=social)](https://x.com/FrankBria18044)
 
 > [!WARNING]
-> **Prerequisite:** CodeFRAME requires an `ANTHROPIC_API_KEY` from [console.anthropic.com](https://console.anthropic.com/). Get your key before running any `cf` command.
+> **Prerequisite:** CodeFRAME requires an API key matching your LLM provider — by default an `ANTHROPIC_API_KEY` from [console.anthropic.com](https://console.anthropic.com/), or `OPENAI_API_KEY` when using `--llm-provider openai` (local providers like Ollama need no key). Get your key before running any `cf` command.
 
 ---
 
@@ -147,7 +157,7 @@ THE CLOSED LOOP
 ---
 
 > [!NOTE]
-> **CodeFRAME is in public beta (`0.9.0`).** The vision and the Golden Path CLI
+> **CodeFRAME is in public beta (`0.9.2`).** The vision and the Golden Path CLI
 > (`cf init/prd/tasks/work/proof/pr`) and v2 API are stable enough to build on;
 > the web UI and anything marked "in progress" in
 > [`docs/PRODUCT_ROADMAP.md`](docs/PRODUCT_ROADMAP.md) are still moving, and
@@ -199,7 +209,20 @@ cf tasks generate        # Decompose PRD into atomic tasks with dependencies
 cf tasks list            # Review what was generated
 ```
 
-**Step 5 — Build, Prove, and Ship**
+**Step 5 — Promote the tasks you want to run**
+
+`cf tasks generate` creates tasks in `BACKLOG` so you can review them before an
+agent touches your code. Move the ones you approve to `READY`:
+
+```bash
+cf tasks set status READY --all --from BACKLOG   # every BACKLOG task
+cf tasks set status <task-id> READY              # one task (note: id before status)
+```
+
+Skipping this step is why `--all-ready` below would otherwise report
+`No READY tasks found` and do nothing.
+
+**Step 6 — Build, Prove, and Ship**
 
 ```bash
 cf work batch run --all-ready   # Execute all READY tasks (delegates to agent)
@@ -209,6 +232,11 @@ cf pr create                    # Open a PR with proof report attached
 
 That is the entire workflow. Everything else is optional.
 
+> **See it run from scratch.** [Cold start on a clean machine](docs/demos/quickstart-cleanroom.md)
+> is a narrated walkthrough of exactly these steps in a throwaway container —
+> real transcripts, per-step timings, and the rough edges left in. Reproduce it
+> with `scripts/quickstart-cleanroom/run.sh`.
+
 ---
 
 ## Architecture
@@ -336,6 +364,21 @@ cf proof list                         # List all proof requirements
 cf proof status                       # Summary status across all gates
 cf proof show <id>                    # Detail for a specific requirement
 cf proof waive <id> --reason "..."    # Waive a requirement with justification
+```
+
+**How each gate is verified.** `UNIT` and `CONTRACT` run pytest and `SEC` runs
+ruff directly. The other gates — `E2E`, `VISUAL`, `A11Y`, `PERF`, `DEMO` — have
+no dedicated tool runner and are enforced through their **evidence rules**:
+`cf proof capture` generates a `test_a11y_*` / `test_perf_*` / … stub per
+obligation, and once you implement that test it is run scoped by name, so the
+obligation passes or fails on real evidence. A named test that does not exist
+is a failure, not a pass.
+
+`MANUAL` is deliberately never machine-verified — its `manual_check_*` rules
+mean a human has to look — so a MANUAL obligation reports `unverifiable` and is
+resolved by waiving it with a justification.
+
+```bash
 
 # Checkpoints and gates
 cf review                             # Run verification gates
@@ -345,16 +388,18 @@ cf checkpoint restore <id>            # Roll back to checkpoint
 
 # Debugging
 cf work replay <id>                   # Replay and debug a past execution
-cf tui                                # Launch TUI dashboard
+cf dashboard                          # Launch TUI dashboard
 ```
 
 ### SHIP -- Delivery
 
 ```bash
 cf pr create                          # Create PR from current branch
-cf pr status                          # PR status and review state
-cf pr checks                          # CI check results
+cf pr list                            # List open PRs
+cf pr status                          # PR status, review state and CI checks
+cf pr get <number>                    # Details for one PR
 cf pr merge                           # Merge approved PR
+cf pr close <number>                  # Close a PR without merging
 cf commit                             # Commit verified changes
 cf patch export                       # Export changes as patch
 ```
@@ -366,14 +411,14 @@ cf patch export                       # Export changes as patch
 CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser:
 
 - **THINK**: Socratic PRD generation with recursive stress-testing, LLM-powered task decomposition with dependency graphs, 5 PRD templates, 7 task templates, CPM-based scheduling
-- **BUILD**: ReAct agent with 7 tools, self-correction with loop prevention, verification gates (ruff/pytest/BUILD), stall detection with configurable recovery (retry/blocker/fail), batch execution (serial/parallel/auto), human-in-the-loop blockers, checkpointing, state persistence, replay/debug mode (`cf work replay`), dynamic config reload, TUI dashboard (`cf tui`)
+- **BUILD**: ReAct agent with 7 tools, self-correction with loop prevention, verification gates (ruff/pytest/BUILD), stall detection with configurable recovery (retry/blocker/fail), batch execution (serial/parallel/auto), human-in-the-loop blockers, checkpointing, state persistence, replay/debug mode (`cf work replay`), dynamic config reload, TUI dashboard (`cf dashboard`)
 - **PROVE**: PROOF9 quality memory system — 9-gate evidence-based verification (`cf proof run/capture/list/status/show/waive`), every glitch becomes a permanent proof obligation
 - **SHIP**: GitHub PR workflow, environment validation, task self-diagnosis
 - **Engine adapters**: Claude Code, Codex, OpenCode, Kilocode, and built-in ReAct — all via `--engine` flag
 - **Multi-provider LLM**: Anthropic (default) or any OpenAI-compatible endpoint (OpenAI, Ollama, vLLM, LM Studio, Qwen, Deepseek) via `--llm-provider` / `--llm-model` or env vars
 - **Server layer** (optional): FastAPI with 16+ v2 routers, API key auth, rate limiting, SSE streaming, WebSocket endpoints (agent chat, interactive terminal), OpenAPI docs
 - **Web UI**: Workspace view, PRD discovery, Task board, Blocker resolution, Review/commit, PROOF9 requirements list + per-gate evidence display + run history panel + waiver audit trail, agent chat panel with streaming tool-call display, interactive terminal for session workspaces, Sessions list with active-session badge
-- **Test suite**: 4200+ tests, 88% coverage
+- **Test suite**: 5100+ tests, 81.9% measured coverage (CI enforces an 80% floor)
 
 ---
 
@@ -389,7 +434,7 @@ CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser
 - [x] Worktree isolation for parallel agent execution
 - [x] Reconciliation layer for multi-agent output
 - [x] Replay/debug mode (`cf work replay`)
-- [x] TUI dashboard (`cf tui`)
+- [x] TUI dashboard (`cf dashboard`)
 - [x] Dynamic config reload during batch execution
 - [x] Multi-provider LLM -- Anthropic, OpenAI, or any OpenAI-compatible endpoint
 - [ ] Engine performance tracking and automatic routing
@@ -398,12 +443,12 @@ CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser
 - [x] PROOF9 -- 9-gate evidence-based quality system
 - [x] `cf proof capture` -- Glitch-to-requirement closed loop
 - [x] Quality compounding: every failure becomes a permanent proof obligation
-- [ ] Run gates from the web UI (backend ready, frontend pending)
-- [ ] Glitch capture web UI
-- [ ] Merge gating on PROOF9 pass (web UI)
+- [x] Run gates from the web UI -- live progress, per-gate evidence, run history
+- [x] Glitch capture web UI -- `CaptureGlitchModal` plus the REQ detail view at `/proof/[req_id]`
+- [x] Merge gating on PROOF9 pass -- enforced server-side at the merge API, with an explicit audited override (actor + reason)
 
 ### SHIP (delivery confidence)
-- [ ] PR status tracking + CI check display in web UI
+- [x] PR status tracking + CI check display in web UI (`PRStatusPanel` on `/review`)
 - [ ] Post-merge glitch capture loop
 
 ### Web UI
@@ -415,8 +460,8 @@ CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser
 - [x] PROOF9 requirements list, detail, evidence history, sort/filter controls, waiver with audit trail
 - [x] Interactive Agent Sessions — chat panel (tool calls, thinking blocks), XTerm.js terminal, SplitPane layout
 - [x] Run gates button, live gate progress, per-gate evidence display, run history panel (PROOF9 page)
-- [ ] Glitch capture form and REQ detail view
-- [ ] PR status panel with PROOF9-gated merge button
+- [x] Glitch capture form and REQ detail view (markdown description, scope metadata, obligations table, sortable evidence history)
+- [x] PR status panel with PROOF9-gated merge button (gate also enforced server-side)
 
 ---
 
@@ -434,7 +479,7 @@ export OPENAI_BASE_URL=http://localhost:11434/v1  # for Ollama, vLLM, LM Studio,
 # Per-workspace: .codeframe/config.yaml supports an `llm:` block for the same options
 
 # Optional
-export DATABASE_PATH=./codeframe.db         # Default: in-memory SQLite
+export DATABASE_PATH=./codeframe.db         # Default: ./.codeframe/state.db
 export RATE_LIMIT_ENABLED=true              # API rate limiting
 export RATE_LIMIT_DEFAULT=100/minute        # Default limit
 ```
@@ -489,7 +534,7 @@ cd web-ui && npm run build             # Production build verification
 4. Run tests: `uv run pytest`
 5. Submit PR with tests and clear description
 
-Code standards: PEP 8, `ruff` for linting, type hints required, 85%+ test coverage.
+Code standards: PEP 8, `ruff` for linting, type hints required, 80%+ test coverage (enforced by CI via `.coveragerc`).
 
 During the beta, feature ideas go to [Discussions -> Ideas](https://github.com/frankbria/codeframe/discussions/categories/ideas) before code. See [CONTRIBUTING.md](CONTRIBUTING.md) for what's stable, what isn't, and how to propose changes.
 
@@ -501,6 +546,7 @@ CodeFRAME is in **public beta**.
 
 - **Security:** found a vulnerability? Report it privately via [GitHub private vulnerability reporting](https://github.com/frankbria/codeframe/security/advisories/new) (or `security@codeframe.sh`) -- never a public issue. See [SECURITY.md](SECURITY.md) for scope and response expectations.
 - **Licensing:** CodeFRAME is [AGPL-3.0](LICENSE), an open-core stance. [LICENSING.md](LICENSING.md) explains what that means for individuals, internal company use, and embedding -- and how to reach us about **commercial licensing or a hosted offering** (both planned). Commercial inquiries: `licensing@codeframe.sh`.
+- **Trademark:** the code is AGPL-3.0, but the **CodeFRAME name and logo are trademarks** and are *not* covered by the code license. See [TRADEMARKS.md](TRADEMARKS.md) before using the name for a fork or product.
 - **Early access / design partners:** email `hello@codeframe.sh` or reply to the pinned [Discussion](https://github.com/frankbria/codeframe/discussions) to be included.
 - **Help & community:** [Discussions -> Q&A](https://github.com/frankbria/codeframe/discussions/categories/q-a) for questions, [Ideas](https://github.com/frankbria/codeframe/discussions/categories/ideas) for feature requests, and [bug reports](https://github.com/frankbria/codeframe/issues/new/choose) for confirmed bugs.
 
@@ -510,8 +556,12 @@ CodeFRAME is in **public beta**.
 
 [AGPL-3.0](LICENSE) -- Free to use, modify, and distribute. Derivative works and network services must release source code under the same license. See [LICENSING.md](LICENSING.md) for a plain-language explanation and commercial options.
 
+The code is AGPL-3.0; the **CodeFRAME™ name and logo are trademarks** of Noatak Enterprises, LLC, dba Bria Strategy Group, and are not licensed under the AGPL -- see [TRADEMARKS.md](TRADEMARKS.md).
+
 ---
 
 **Built by [Frank Bria](https://x.com/FrankBria18044)**
 
 [Issues](https://github.com/frankbria/codeframe/issues) | [Discussions](https://github.com/frankbria/codeframe/discussions) | [Documentation](https://github.com/frankbria/codeframe/tree/main/docs)
+
+_CodeFRAME™ is a trademark of Noatak Enterprises, LLC, dba Bria Strategy Group. All rights reserved._

{codeframe_ai-0.9.0 → codeframe_ai-0.9.2}/README.md

@@ -1,17 +1,17 @@
 ![CodeFRAME Header](./codeframe_github_header_1600x500.png)
 
-# CodeFRAME
+# CodeFRAME™
 
 ![Status](https://img.shields.io/badge/status-beta-orange)
 [![PyPI](https://img.shields.io/pypi/v/codeframe-ai)](https://pypi.org/project/codeframe-ai/)
 ![License](https://img.shields.io/badge/license-AGPL--3.0-blue)
 ![Python](https://img.shields.io/badge/python-3.11%2B-blue)
 [![CI](https://github.com/frankbria/codeframe/actions/workflows/test.yml/badge.svg)](https://github.com/frankbria/codeframe/actions/workflows/test.yml)
-![Coverage](https://img.shields.io/badge/coverage-88%25-brightgreen)
+![Coverage](https://img.shields.io/badge/coverage-80%25-brightgreen)
 [![Follow on X](https://img.shields.io/twitter/follow/FrankBria18044?style=social)](https://x.com/FrankBria18044)
 
 > [!WARNING]
-> **Prerequisite:** CodeFRAME requires an `ANTHROPIC_API_KEY` from [console.anthropic.com](https://console.anthropic.com/). Get your key before running any `cf` command.
+> **Prerequisite:** CodeFRAME requires an API key matching your LLM provider — by default an `ANTHROPIC_API_KEY` from [console.anthropic.com](https://console.anthropic.com/), or `OPENAI_API_KEY` when using `--llm-provider openai` (local providers like Ollama need no key). Get your key before running any `cf` command.
 
 ---
 
@@ -74,7 +74,7 @@ THE CLOSED LOOP
 ---
 
 > [!NOTE]
-> **CodeFRAME is in public beta (`0.9.0`).** The vision and the Golden Path CLI
+> **CodeFRAME is in public beta (`0.9.2`).** The vision and the Golden Path CLI
 > (`cf init/prd/tasks/work/proof/pr`) and v2 API are stable enough to build on;
 > the web UI and anything marked "in progress" in
 > [`docs/PRODUCT_ROADMAP.md`](docs/PRODUCT_ROADMAP.md) are still moving, and
@@ -126,7 +126,20 @@ cf tasks generate        # Decompose PRD into atomic tasks with dependencies
 cf tasks list            # Review what was generated
 ```
 
-**Step 5 — Build, Prove, and Ship**
+**Step 5 — Promote the tasks you want to run**
+
+`cf tasks generate` creates tasks in `BACKLOG` so you can review them before an
+agent touches your code. Move the ones you approve to `READY`:
+
+```bash
+cf tasks set status READY --all --from BACKLOG   # every BACKLOG task
+cf tasks set status <task-id> READY              # one task (note: id before status)
+```
+
+Skipping this step is why `--all-ready` below would otherwise report
+`No READY tasks found` and do nothing.
+
+**Step 6 — Build, Prove, and Ship**
 
 ```bash
 cf work batch run --all-ready   # Execute all READY tasks (delegates to agent)
@@ -136,6 +149,11 @@ cf pr create                    # Open a PR with proof report attached
 
 That is the entire workflow. Everything else is optional.
 
+> **See it run from scratch.** [Cold start on a clean machine](docs/demos/quickstart-cleanroom.md)
+> is a narrated walkthrough of exactly these steps in a throwaway container —
+> real transcripts, per-step timings, and the rough edges left in. Reproduce it
+> with `scripts/quickstart-cleanroom/run.sh`.
+
 ---
 
 ## Architecture
@@ -263,6 +281,21 @@ cf proof list                         # List all proof requirements
 cf proof status                       # Summary status across all gates
 cf proof show <id>                    # Detail for a specific requirement
 cf proof waive <id> --reason "..."    # Waive a requirement with justification
+```
+
+**How each gate is verified.** `UNIT` and `CONTRACT` run pytest and `SEC` runs
+ruff directly. The other gates — `E2E`, `VISUAL`, `A11Y`, `PERF`, `DEMO` — have
+no dedicated tool runner and are enforced through their **evidence rules**:
+`cf proof capture` generates a `test_a11y_*` / `test_perf_*` / … stub per
+obligation, and once you implement that test it is run scoped by name, so the
+obligation passes or fails on real evidence. A named test that does not exist
+is a failure, not a pass.
+
+`MANUAL` is deliberately never machine-verified — its `manual_check_*` rules
+mean a human has to look — so a MANUAL obligation reports `unverifiable` and is
+resolved by waiving it with a justification.
+
+```bash
 
 # Checkpoints and gates
 cf review                             # Run verification gates
@@ -272,16 +305,18 @@ cf checkpoint restore <id>            # Roll back to checkpoint
 
 # Debugging
 cf work replay <id>                   # Replay and debug a past execution
-cf tui                                # Launch TUI dashboard
+cf dashboard                          # Launch TUI dashboard
 ```
 
 ### SHIP -- Delivery
 
 ```bash
 cf pr create                          # Create PR from current branch
-cf pr status                          # PR status and review state
-cf pr checks                          # CI check results
+cf pr list                            # List open PRs
+cf pr status                          # PR status, review state and CI checks
+cf pr get <number>                    # Details for one PR
 cf pr merge                           # Merge approved PR
+cf pr close <number>                  # Close a PR without merging
 cf commit                             # Commit verified changes
 cf patch export                       # Export changes as patch
 ```
@@ -293,14 +328,14 @@ cf patch export                       # Export changes as patch
 CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser:
 
 - **THINK**: Socratic PRD generation with recursive stress-testing, LLM-powered task decomposition with dependency graphs, 5 PRD templates, 7 task templates, CPM-based scheduling
-- **BUILD**: ReAct agent with 7 tools, self-correction with loop prevention, verification gates (ruff/pytest/BUILD), stall detection with configurable recovery (retry/blocker/fail), batch execution (serial/parallel/auto), human-in-the-loop blockers, checkpointing, state persistence, replay/debug mode (`cf work replay`), dynamic config reload, TUI dashboard (`cf tui`)
+- **BUILD**: ReAct agent with 7 tools, self-correction with loop prevention, verification gates (ruff/pytest/BUILD), stall detection with configurable recovery (retry/blocker/fail), batch execution (serial/parallel/auto), human-in-the-loop blockers, checkpointing, state persistence, replay/debug mode (`cf work replay`), dynamic config reload, TUI dashboard (`cf dashboard`)
 - **PROVE**: PROOF9 quality memory system — 9-gate evidence-based verification (`cf proof run/capture/list/status/show/waive`), every glitch becomes a permanent proof obligation
 - **SHIP**: GitHub PR workflow, environment validation, task self-diagnosis
 - **Engine adapters**: Claude Code, Codex, OpenCode, Kilocode, and built-in ReAct — all via `--engine` flag
 - **Multi-provider LLM**: Anthropic (default) or any OpenAI-compatible endpoint (OpenAI, Ollama, vLLM, LM Studio, Qwen, Deepseek) via `--llm-provider` / `--llm-model` or env vars
 - **Server layer** (optional): FastAPI with 16+ v2 routers, API key auth, rate limiting, SSE streaming, WebSocket endpoints (agent chat, interactive terminal), OpenAPI docs
 - **Web UI**: Workspace view, PRD discovery, Task board, Blocker resolution, Review/commit, PROOF9 requirements list + per-gate evidence display + run history panel + waiver audit trail, agent chat panel with streaming tool-call display, interactive terminal for session workspaces, Sessions list with active-session badge
-- **Test suite**: 4200+ tests, 88% coverage
+- **Test suite**: 5100+ tests, 81.9% measured coverage (CI enforces an 80% floor)
 
 ---
 
@@ -316,7 +351,7 @@ CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser
 - [x] Worktree isolation for parallel agent execution
 - [x] Reconciliation layer for multi-agent output
 - [x] Replay/debug mode (`cf work replay`)
-- [x] TUI dashboard (`cf tui`)
+- [x] TUI dashboard (`cf dashboard`)
 - [x] Dynamic config reload during batch execution
 - [x] Multi-provider LLM -- Anthropic, OpenAI, or any OpenAI-compatible endpoint
 - [ ] Engine performance tracking and automatic routing
@@ -325,12 +360,12 @@ CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser
 - [x] PROOF9 -- 9-gate evidence-based quality system
 - [x] `cf proof capture` -- Glitch-to-requirement closed loop
 - [x] Quality compounding: every failure becomes a permanent proof obligation
-- [ ] Run gates from the web UI (backend ready, frontend pending)
-- [ ] Glitch capture web UI
-- [ ] Merge gating on PROOF9 pass (web UI)
+- [x] Run gates from the web UI -- live progress, per-gate evidence, run history
+- [x] Glitch capture web UI -- `CaptureGlitchModal` plus the REQ detail view at `/proof/[req_id]`
+- [x] Merge gating on PROOF9 pass -- enforced server-side at the merge API, with an explicit audited override (actor + reason)
 
 ### SHIP (delivery confidence)
-- [ ] PR status tracking + CI check display in web UI
+- [x] PR status tracking + CI check display in web UI (`PRStatusPanel` on `/review`)
 - [ ] Post-merge glitch capture loop
 
 ### Web UI
@@ -342,8 +377,8 @@ CodeFRAME delivers the full Think-Build-Prove-Ship loop from the CLI and browser
 - [x] PROOF9 requirements list, detail, evidence history, sort/filter controls, waiver with audit trail
 - [x] Interactive Agent Sessions — chat panel (tool calls, thinking blocks), XTerm.js terminal, SplitPane layout
 - [x] Run gates button, live gate progress, per-gate evidence display, run history panel (PROOF9 page)
-- [ ] Glitch capture form and REQ detail view
-- [ ] PR status panel with PROOF9-gated merge button
+- [x] Glitch capture form and REQ detail view (markdown description, scope metadata, obligations table, sortable evidence history)
+- [x] PR status panel with PROOF9-gated merge button (gate also enforced server-side)
 
 ---
 
@@ -361,7 +396,7 @@ export OPENAI_BASE_URL=http://localhost:11434/v1  # for Ollama, vLLM, LM Studio,
 # Per-workspace: .codeframe/config.yaml supports an `llm:` block for the same options
 
 # Optional
-export DATABASE_PATH=./codeframe.db         # Default: in-memory SQLite
+export DATABASE_PATH=./codeframe.db         # Default: ./.codeframe/state.db
 export RATE_LIMIT_ENABLED=true              # API rate limiting
 export RATE_LIMIT_DEFAULT=100/minute        # Default limit
 ```
@@ -416,7 +451,7 @@ cd web-ui && npm run build             # Production build verification
 4. Run tests: `uv run pytest`
 5. Submit PR with tests and clear description
 
-Code standards: PEP 8, `ruff` for linting, type hints required, 85%+ test coverage.
+Code standards: PEP 8, `ruff` for linting, type hints required, 80%+ test coverage (enforced by CI via `.coveragerc`).
 
 During the beta, feature ideas go to [Discussions -> Ideas](https://github.com/frankbria/codeframe/discussions/categories/ideas) before code. See [CONTRIBUTING.md](CONTRIBUTING.md) for what's stable, what isn't, and how to propose changes.
 
@@ -428,6 +463,7 @@ CodeFRAME is in **public beta**.
 
 - **Security:** found a vulnerability? Report it privately via [GitHub private vulnerability reporting](https://github.com/frankbria/codeframe/security/advisories/new) (or `security@codeframe.sh`) -- never a public issue. See [SECURITY.md](SECURITY.md) for scope and response expectations.
 - **Licensing:** CodeFRAME is [AGPL-3.0](LICENSE), an open-core stance. [LICENSING.md](LICENSING.md) explains what that means for individuals, internal company use, and embedding -- and how to reach us about **commercial licensing or a hosted offering** (both planned). Commercial inquiries: `licensing@codeframe.sh`.
+- **Trademark:** the code is AGPL-3.0, but the **CodeFRAME name and logo are trademarks** and are *not* covered by the code license. See [TRADEMARKS.md](TRADEMARKS.md) before using the name for a fork or product.
 - **Early access / design partners:** email `hello@codeframe.sh` or reply to the pinned [Discussion](https://github.com/frankbria/codeframe/discussions) to be included.
 - **Help & community:** [Discussions -> Q&A](https://github.com/frankbria/codeframe/discussions/categories/q-a) for questions, [Ideas](https://github.com/frankbria/codeframe/discussions/categories/ideas) for feature requests, and [bug reports](https://github.com/frankbria/codeframe/issues/new/choose) for confirmed bugs.
 
@@ -437,8 +473,12 @@ CodeFRAME is in **public beta**.
 
 [AGPL-3.0](LICENSE) -- Free to use, modify, and distribute. Derivative works and network services must release source code under the same license. See [LICENSING.md](LICENSING.md) for a plain-language explanation and commercial options.
 
+The code is AGPL-3.0; the **CodeFRAME™ name and logo are trademarks** of Noatak Enterprises, LLC, dba Bria Strategy Group, and are not licensed under the AGPL -- see [TRADEMARKS.md](TRADEMARKS.md).
+
 ---
 
 **Built by [Frank Bria](https://x.com/FrankBria18044)**
 
 [Issues](https://github.com/frankbria/codeframe/issues) | [Discussions](https://github.com/frankbria/codeframe/discussions) | [Documentation](https://github.com/frankbria/codeframe/tree/main/docs)
+
+_CodeFRAME™ is a trademark of Noatak Enterprises, LLC, dba Bria Strategy Group. All rights reserved._