[zwanski-start]

Closes #132

What changed

Most AutoForge data already lives in .autoforge/. Two things were still landing in the project root next to the generated app: a copy of app_spec.txt and the agent's claude-progress.txt. This PR moves both into .autoforge/, so the root holds only the application (plus CLAUDE.md / .claude/, which Claude Code only reads from the root).

• Templates (coding, initializer, auto_improve) now read the spec from .autoforge/prompts/app_spec.txt and write notes to .autoforge/claude-progress.txt. auto_improve falls back to the old root paths.
• copy_spec_to_project no longer copies the spec to the root by default. It only makes the root copy when a project prompt still refers to a bare app_spec.txt, e.g. a customised prompt.
• Migration v2 (_migrate_v1_to_v2, CURRENT_MIGRATION_VERSION = 2) runs on the next agent start for existing projects:
  • copies a root-only app_spec.txt into the prompts dir if the prompts dir has none
  • moves the root claude-progress.txt into .autoforge/, but never overwrites one that's already there
  • rewrites bare app_spec.txt / claude-progress.txt references in the project's initializer/coding/testing prompts; paths that already have a prefix are left alone, so it's safe to run twice
  • deletes the root app_spec.txt only if it is byte-identical to the canonical spec. If it was edited, it's kept and a note is printed.
• Docs: README's "Generated Project Structure" section now shows the real .autoforge/ layout, and CLAUDE.md is updated to match.

Verification

• New test_project_layout.py (8 tests): templates have no root references, new projects get no root copy, legacy prompts still get one, the migration moves and rewrites files, running it twice changes nothing, an edited root spec is kept, a root-only spec is copied into the prompts dir, and existing progress notes are never overwritten.
• ruff check . and mypy on the changed files pass. test_security.py, test_client.py and test_dependency_resolver.py pass.
• There are no UI changes, so I didn't run a browser check.

Assumptions

• claude-progress.txt counts as an AutoForge file, so it moves too. It is not gitignored inside .autoforge/, so it can still be committed with the project as before.
• CLAUDE.md, .claude/skills/ and .playwright/ stay at the root because Claude Code and Playwright CLI look for them there.
• If a root spec copy differs from the canonical one, the canonical spec (.autoforge/prompts/app_spec.txt) wins, because that is the file the UI edits.

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Barbara (cubefarm agent, in a fresh session) · Round: 1 · Author: Guido

New projects no longer get an app_spec.txt copy or claude-progress.txt in the project root, and existing v1 and v0 projects are migrated into .autoforge/ safely: the progress notes are moved, prompts are rewritten, an identical root spec is removed, an edited one is kept, and a second run changes nothing. All new tests, the security tests, ruff, the UI build and the UI lint pass. The full pytest and mypy failures are the same on master. The server starts without an API key and the UI loads with no console errors.

	Check	Details
✅	New project gets no AutoForge files in the root	POST /api/projects (isolated HOME) created only .autoforge, .claude, .gitignore and .playwright in the root; .migration_version=2; copy_spec_to_project did not create a root app_spec.txt.
✅	Migrating a v1 project built from master's templates	Used master's actual templates plus a root app_spec.txt copy and a UTF-8 claude-progress.txt. The migration moved the notes to .autoforge/, rewrote the coding and initializer prompts (coding_prompt.md now matches the new template byte for byte) and removed the duplicate root spec. The root was left with only .autoforge. A second run returned [].
✅	Migrating a v0 project (root prompts/) through both migrations	migrate_project_layout followed by migrate_project_to_current left the root with only the app (src/) plus .autoforge, .claude, .playwright and .gitignore.
✅	Edge cases: edited spec, existing notes, idempotency, path prefixes	Covered by the new tests and a probe script. Already-prefixed paths such as docs/app_spec.txt are not rewritten. Non-blocking gap: a bare './app_spec.txt' in a custom prompt is neither detected nor rewritten.
✅	Agent can read and write .autoforge/ paths	client.py grants Read/Write/Edit on ./** within the project, so the .autoforge/ files the new templates point to are reachable. security.py and the localhost-only middleware are unchanged.
✅	Backend tests, lint and type checks	test_project_layout.py 8/8 passed; security tests 169 + 9 passed; ruff clean. The 21 test_devserver_security.py failures and 24 mypy errors are identical on origin/master.
✅	UI build and lint	The build succeeds; lint has 0 errors and 6 warnings. The PR has no UI changes.
✅	Browser smoke test with no API key	Loaded the app on :5443, selected the new project; the dashboard rendered, the WebSocket showed Live, and the console had 0 errors.
⏭️	Playwright e2e suite	The PR does not touch the UI.

🧪 Commands run

Command	Result
venv/bin/python -m pytest -q test_project_layout.py	8 passed
venv/bin/python -m pytest -q	152 passed, 21 failed (all test_devserver_security.py; same 21 fail on origin/master)
python test_security.py	169 passed, 0 failed
python test_security_integration.py	9 passed, 0 failed
ruff check .	All checks passed
mypy . --exclude venv	24 errors, same count as origin/master; prompts.py and test_project_layout.py add none
npm --prefix ui run build	success
npm --prefix ui run lint	0 errors, 6 warnings
python probe.py (throwaway script for migration scenarios)	all scenarios behaved as expected; './app_spec.txt' edge case noted
HOME=<tmp> uvicorn server.main:app --port 5443 + curl /api/projects (GET, POST, bad name, unknown project prompts)	200 / 200 / 422 / 404

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}