docs: repo hygiene + docs drift cleanup (#771)

[frankbria]

Closes #771.

All 7 claims in the issue were verified true against the tree before any change.

What changed

#	Fix	Evidence it was broken
1	Untrack test_output.log + coverage.json, gitignore both (+ *_output.log)	9,569-line log + 393KB JSON tracked, shipping in the public sdist
2	OpenAPI license_info MIT → AGPL-3.0-or-later	Package is AGPL (pyproject.toml:11); API docs advertised MIT
3	Delete false TODO(#336) in events_v2.py	Auth is enforced — server.py mounts the router dependencies=_AUTH
4	CORS print() → logger.info()	Module-level print dumped CORS config to stdout on every import
5	README cf tui → cf dashboard (3 spots)	No tui command exists anywhere in the codebase
6	PRD.md → pointer stub	Described the abandoned v1 multi-agent product; linked a root SPRINTS.md that no longer exists
7	AGENTS.md → pointer stub	Duplicated CLAUDE.md, drifted 2 phases, referenced the deleted server/ dir
8	TESTING.md broken SPRINTS.md link (drive-by)	Same defect class, one line — SPRINTS.md now lives in legacydocs/

Net: +36 / −10,370.

On the two doc stubs

The issue allows "refreshed or pointed at CLAUDE.md". Both are pointed, deliberately:
duplication is the actual defect. AGENTS.md was a copy of CLAUDE.md that drifted;
re-syncing it just restarts the clock on the same bug. PRD.md documented a product
that no longer exists. Inbound links (TESTING.md, specs/CODEFRAME_SPEC.md) still
resolve, and the v1 content remains in legacydocs/.

AGENTS.md stays a real file rather than a symlink because core/config_watcher.py:40
treats that filename as first-class config.

Verification

• uv run pytest tests/ui/ → 553 passed
• uv run ruff check . → clean
• OpenAPI info.license → AGPL-3.0-or-later (asserted against a real app.openapi())
• CORS now emits via logger at INFO with identical content; no stdout on import
• cf dashboard --help → exits 0; cf tui --help → No such command 'tui'
• git check-ignore -v confirms both artifacts ignored by the new rules
• Third-party review (codex): no findings; independently re-verified each claim

Known limitations

• Scope is exactly the issue's 7 items + 1 same-class drive-by. Other legacy docs
  (specs/, legacydocs/, docs/archive/) still contain v1-era references; they are
  already marked historical and were left alone.
• Deleting the tracked artifacts is what keeps them out of the sdist — there is no
  MANIFEST.in to tighten.

[github-actions]

Precision bug-hunting review in progress

• Gather PR diff + existing comments
• Inspect code hunks (server.py, events_v2.py, .gitignore)
• Verify AGENTS.md stub doesn't break config_watcher.py
• Post inline findings + summary

Reviewing only concrete defects (logic, security, data-loss, contract breaks). Style/architecture/coverage handled separately.

View job run

[claude]

Review

Verified this against the merged tree (matches what's described — no substantive prior reviews to reconcile with, just a placeholder bot comment). All 8 changes check out:

Correctness — all confirmed:

• events_v2.router really is mounted with dependencies=_AUTH in server.py:765 — the removed TODO(#336) was indeed false, good catch.
• logger (codeframe/ui/server.py:91) is defined well before the CORS logging call at line 639, so the print() → logger.info() swap is safe — no forward-reference issue despite the diff hunk header pointing at lifespan (the code is actually module-level, unrelated to that function).
• AGENTS.md is genuinely watched as config in core/config_watcher.py:40 (_CONFIG_FILES = ("CODEFRAME.md", "AGENTS.md", "CLAUDE.md")) — good justification for keeping it a real file instead of a symlink.
• pyproject.toml:11 is license = {text = "AGPL-3.0-or-later"}, matching the new OpenAPI license_info.
• No remaining cf tui references anywhere in current docs; cf dashboard is a real command (codeframe/cli/dashboard_commands.py, wired in cli/app.py:5828).
• legacydocs/SPRINTS.md exists, so the TESTING.md link fix resolves correctly. test_output.log and coverage.json are both gone from the tree and now covered by .gitignore.

Minor, non-blocking observations:

• TESTING.md itself is still Sprint-1-era content (references codeframe.agents.lead_agent, a db.create_agent(...) API, /api/projects REST paths, etc. that don't match the current architecture) — only the broken link at the top was fixed. That's consistent with the PR's stated scope (issue's 7 items + one same-class drive-by), just flagging it in case a future hygiene pass wants to fold this file into the same pointer-stub treatment as PRD.md/AGENTS.md, since it's arguably the same defect class.
• specs/CODEFRAME_SPEC.md still has two prose (non-link) mentions of SPRINTS.md — also out of scope per the PR's stated boundaries (specs/, legacydocs/, docs/archive/ already marked historical), not a defect introduced here.

No bugs, security issues, or test-coverage gaps found. This is a clean, well-scoped hygiene PR — every claim in the description is verifiable against the tree, and the diff doesn't reach beyond what's described. Nice work keeping the two doc-stub deletions honest (pointing at CLAUDE.md rather than re-syncing duplicate content) rather than just patching the broken links in place.

[frankbria]

Third-party review (codex) — post-PR

1 real defect found and fixed (d6e44c9):

• PRD.md:18 — the stub claimed the v1 requirements were "preserved in legacydocs/", but no legacydocs/PRD.md exists; the content is only in git history. A false doc claim inside a PR that fixes false doc claims. Fixed by pointing at git log -- PRD.md (verified retrievable) rather than re-adding 543 lines of abandoned v1 docs, which would undo this PR's cleanup.

Cleared by the reviewer:

• Markdown links in the new PRD.md / AGENTS.md / TESTING.md all resolve.
• No code or test depends on the removed AGENTS.md sections (config_watcher loads it as raw preferences; a pointer file is fine).
• License change to AGPL-3.0-or-later matches LICENSE, pyproject.toml, README.md, LICENSING.md, and TRADEMARKS.md.

The pre-PR review pass (also codex) returned no findings.

[github-actions]

Claude finished @frankbria's task in 3m 6s —— View job

---

✅ GLM precision review: no defects found

Re-verified the two code hunks + the one non-trivial risk (does the AGENTS.md pointer stub break config_watcher?) against the checked-out tree. Consistent with the two prior claude passes and the codex review.

Area	Verdict
events_v2.py — removed stale TODO(#336)	Router is mounted with dependencies=_AUTH (_AUTH = [Depends(require_method_scope)], server.py:757→765). The TODO was genuinely false; removing a comment is not a logic change. ✓
server.py — print() → logger.info() (CORS origins)	logger is module-level at server.py:91, defined before the call at :639 (no forward-ref). %s/%r format a list + str cleanly — no formatting crash at import. ✓
.gitignore — added coverage.json, test_output.log, *_output.log	git ls-files for these patterns returns no matches — no legitimately-tracked file gets silently untracked. The glob only catches the intended artifacts. ✓
AGENTS.md pointer stub vs config_watcher.py	_reload() (config_watcher.py:188) wraps load_preferences in try/except: on any parse failure it logs, emits CONFIG_RELOAD_FAILED, and retains the previous config — no crash, no data loss. It also watches the workspace dir, not this repo root. Pointer text becomes innocuous raw_content. ✓

All remaining changes are doc/config deletions (PRD.md, AGENTS.md, README.md, TESTING.md, deleted coverage.json / test_output.log). Link resolution was already cleared by the codex review; nothing here introduces a runtime defect, contract break, or data-loss path.

• Gather PR diff + existing comments (don't repeat prior findings)
• Inspect code hunks (server.py, events_v2.py)
• Verify .gitignore glob + stub files don't break callers
• Post summary

[claude]

Review (re-check)

No new commits since my last pass and the codex post-PR review — re-verified against the current tree and everything still holds:

• events_v2.router is mounted with dependencies=_AUTH (codeframe/ui/server.py:765) — the removed TODO was correctly false.
• logger is module-level (server.py:91), defined well before the CORS log call (server.py:639) — safe.
• AGENTS.md is still read by core/config_watcher.py:40 (_CONFIG_FILES), so keeping it a real pointer file (not a symlink) is still the right call.
• cf dashboard is a real, wired command (cli/app.py:5826-5828); no remaining cf tui references outside docs/archive/ (already historical, out of scope).
• legacydocs/SPRINTS.md exists, so the TESTING.md link resolves; PRD.md's current text correctly points at git log -- PRD.md rather than a nonexistent legacydocs/PRD.md — confirms the codex-flagged defect from the second commit is fixed and stayed fixed.
• test_output.log / coverage.json are gone from the tree and covered by the new .gitignore entries.

Nothing new to add beyond my previous review and the codex third-party review already on this thread. No bugs, security issues, or scope creep — still a clean, well-bounded hygiene PR.