Upload 144 files

AutoForge/.env.example

@@ -0,0 +1,33 @@
+# AutoForge environment configuration
+# Copy to .env and adjust values for your environment.
+
+# PostgreSQL (async SQLAlchemy URL)
+# For Hugging Face Spaces or production, this MUST point to an external PostgreSQL
+# database (e.g., Supabase, Neon, AWS RDS) because Space local disk is ephemeral.
+DATABASE_URL=postgresql+asyncpg://autoforge:autoforge@localhost:5432/autoforge
+
+# JWT signing secret (use a long random string in production)
+SECRET_KEY=change-me-in-production-use-a-long-random-string
+
+# Fernet-compatible encryption key material for API credential storage
+ENCRYPTION_KEY=change-me-32-byte-base64-fernet-key-here=
+
+# JWT algorithm
+ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=1440
+
+# Logging
+LOG_LEVEL=INFO
+
+# Docker sandbox
+DOCKER_HOST=unix:///var/run/docker.sock
+DOCKER_IMAGE=autoforge-sandbox:3.12
+DOCKER_MEMORY_LIMIT=512m
+DOCKER_CPU_LIMIT=1.0
+DOCKER_NETWORK_DISABLED=true
+WORKSPACE_ROOT=/tmp/autoforge/workspaces
+DEFAULT_TIMEOUT=300
+MAX_RETRIES=4
+
+# CORS (comma-separated origins)
+CORS_ORIGINS=http://localhost:3000,http://localhost:5173

AutoForge/.gitignore

@@ -0,0 +1,13 @@
+.env
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+*.egg-info/
+dist/
+build/
+frontend/node_modules/
+frontend/dist/
+.tools/

AutoForge/Dockerfile

@@ -0,0 +1,27 @@
+# Use Node.js for building the Vite frontend
+FROM node:20-alpine AS frontend-builder
+WORKDIR /app/frontend
+COPY frontend/package*.json ./
+RUN npm ci
+COPY frontend/ ./
+RUN npm run build
+
+# Use Python for the FastAPI backend
+FROM python:3.12-slim
+WORKDIR /app
+
+# Install dependencies
+COPY backend/requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy backend code
+COPY backend/ ./backend/
+
+# Copy built frontend from builder stage
+COPY --from=frontend-builder /app/frontend/dist ./frontend/dist
+
+# Expose Hugging Face Space port
+EXPOSE 7860
+
+# Run FastAPI application on port 7860
+CMD ["uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "7860"]

AutoForge/HUGGINGFACE_DEPLOYMENT.md

@@ -0,0 +1,47 @@
+# Hugging Face Space Deployment Guide
+
+Deploying AutoForge to a public Hugging Face (HF) Space enables anyone to interact with the autonomous DAG-based coding agent. 
+
+## Architectural Limitation: Docker Sandbox
+
+**IMPORTANT:** Hugging Face Docker Spaces run containers in an **unprivileged environment**. They do not support mounting the Docker socket (`/var/run/docker.sock`) or running with `--privileged`. 
+
+Because AutoForge correctly enforces a strict security boundary using Docker to sandbox LLM-generated code (`DockerCliRunner`), **AutoForge cannot currently run the code execution step natively inside a standard Hugging Face Space.** 
+
+If Docker is unavailable (as it is inside an HF Space container), the system will safely abort the workflow with `DOCKER_UNAVAILABLE` rather than bypassing the sandbox and risking host compromise.
+
+### Recommended Production Architecture
+To fully deploy this to the public while maintaining security, you must decouple the execution environment:
+1. **Hugging Face Space**: Runs the React frontend and FastAPI orchestration backend (using `Dockerfile.huggingface`).
+2. **External Secure Worker (e.g., AWS EC2 or Modal)**: Runs the Docker Daemon. The `DockerCliRunner` should be refactored to communicate with this worker over a secure gRPC or HTTP API rather than relying on local `shutil.which("docker")`.
+
+## Deployment Instructions (UI & Orchestration Only)
+
+If you wish to deploy the UI and orchestration layers to HF Spaces for demonstration purposes (note that code *execution* tasks will fail safely), follow these steps:
+
+### 1. Space Configuration
+- **Space Type:** Docker Space
+- **Hardware:** Blank (CPU is sufficient for orchestration)
+
+### 2. External PostgreSQL
+Hugging Face Spaces have ephemeral disks. You **must** use an external PostgreSQL provider (like Supabase, Neon, or AWS RDS) to ensure workflow history and user accounts persist across Space restarts.
+
+### 3. Secrets configuration
+In your Hugging Face Space Settings -> Secrets, add the following:
+- `DATABASE_URL`: `postgresql+asyncpg://user:pass@external-host:5432/dbname`
+- `SECRET_KEY`: A long, random string (e.g., generated via `openssl rand -hex 32`).
+- `ENCRYPTION_KEY`: A base64-encoded 32-byte Fernet key for encrypting user LLM API keys.
+
+*Users will securely input their own OpenAI/Gemini API keys directly through the React UI.*
+
+### 4. Required Files
+Ensure the following structure is committed to your Space repository:
+- `backend/`
+- `frontend/`
+- `Dockerfile` (Rename `Dockerfile.huggingface` to `Dockerfile` for HF Spaces)
+
+### 5. Multi-User Safety
+The platform is safe for multi-user public deployment:
+- User API keys are encrypted at rest using `ENCRYPTION_KEY`.
+- The backend enforces `user_id` isolation on all `/workflows/*` endpoints.
+- API keys are injected directly into the LLM adapter at runtime and are never logged.

AutoForge/README.md

@@ -0,0 +1,212 @@
+# AutoForge (AgentOS)
+
+AutoForge is an autonomous DAG-based code generation and verification platform. Users submit natural-language software tasks; the system plans, generates code, tests, analyzes, executes in Docker, verifies, and autonomously repairs failures — with full workflow history persisted in PostgreSQL.
+
+**Project Status:** Fully implemented MVP (Phases 1-20 completed).
+
+The system supports the full autonomous loop:
+- Frontend React DAG visualization and event streaming
+- Gemini 3.1 Pro LLM adapter for planning and code generation
+- Docker Sandbox execution and verification
+- Automated failure diagnosis and repair
+- Full PostgreSQL state persistence and user isolation
+
+## Architecture
+
+```mermaid
+flowchart TB
+    FE[Frontend] --> API[Backend API]
+    API --> ORCH[Workflow Orchestrator]
+    ORCH --> PLANNER[Planner LLM]
+    ORCH --> MEM[(PostgreSQL)]
+    PLANNER --> DAG[DAG Engine]
+    DAG --> CODE[Code Agent]
+    DAG --> TEST[Test Agent]
+    DAG --> ANALYSIS[Static Analysis]
+    CODE --> DOCKER[Docker Sandbox]
+    TEST --> DOCKER
+    ANALYSIS --> DOCKER
+    DOCKER --> VERIFY[Verification]
+```
+
+Phase 1 implements the **API**, **PostgreSQL memory layer**, **authentication**, **LLM provider abstraction**, and **workflow persistence**.
+
+## Repository Structure
+
+```text
+AgentOS/
+├── backend/           # FastAPI application
+│   ├── api/           # HTTP routes (auth, workflows, settings)
+│   ├── agents/        # Agent modules (Phase 2+)
+│   ├── orchestration/ # DAG engine (Phase 2+)
+│   ├── execution/     # Docker sandbox (Phase 2+)
+│   ├── analysis/      # Static analysis (Phase 2+)
+│   ├── memory/        # Workflow repository
+│   ├── llm/           # Provider abstraction
+│   ├── db/            # Models and migrations
+│   └── events/        # Event publisher
+├── frontend/          # React + Vite web UI (Phase 5)
+├── benchmark/         # Evaluation suite (Phase 5)
+├── docker/            # Dockerfiles
+├── tests/             # Backend tests
+├── docker-compose.yml
+└── .env.example
+```
+
+## Local Setup
+
+### Prerequisites
+
+- Docker and Docker Compose
+- Python 3.12+ (for local development without Docker)
+
+### Quick Start (Docker)
+
+```bash
+cp .env.example .env
+docker compose up --build -d
+```
+
+### Hugging Face Space Deployment
+For deploying AutoForge to a public Hugging Face Space, please refer to the [Hugging Face Deployment Guide](HUGGINGFACE_DEPLOYMENT.md).
+
+Services:
+
+| Service    | URL                        |
+|-----------|----------------------------|
+| Frontend  | http://localhost:5173      |
+| Backend   | http://localhost:8000      |
+| API docs  | http://localhost:8000/docs |
+| PostgreSQL| localhost:5432             |
+
+Migrations run automatically when the backend container starts.
+
+### Local Development (without Docker backend)
+
+```bash
+# Start PostgreSQL only
+docker compose up -d postgres
+
+# Create virtual environment and install dependencies
+python -m venv .venv
+source .venv/bin/activate  # Windows: .venv\Scripts\activate
+pip install -r backend/requirements.txt
+
+# Copy and configure environment
+cp .env.example .env
+
+# Run migrations
+alembic upgrade head
+
+# Start API server
+uvicorn backend.main:app --reload --port 8000
+```
+
+### Frontend Development
+
+```bash
+cd frontend
+npm install
+npm run dev
+```
+
+The Vite dev server runs at http://localhost:5173 and proxies `/api` requests to the backend at http://localhost:8000.
+
+For Docker (backend + frontend + PostgreSQL):
+
+```bash
+docker compose up --build
+```
+
+## Environment Variables
+
+See [`.env.example`](.env.example). Key variables:
+
+| Variable       | Description                              |
+|----------------|------------------------------------------|
+| `DATABASE_URL` | Async PostgreSQL connection string       |
+| `SECRET_KEY`   | JWT signing secret                       |
+| `ENCRYPTION_KEY` | Key material for API credential encryption |
+| `MAX_RETRIES`  | Max repair attempts (default: 4)         |
+| `DOCKER_HOST`  | Docker socket for sandbox (later phases) |
+
+Never commit `.env` files with real secrets.
+
+## API Endpoints (Phase 1)
+
+| Method | Endpoint                        | Description              |
+|--------|---------------------------------|--------------------------|
+| POST   | `/auth/signup`                  | Create account           |
+| POST   | `/auth/login`                   | Obtain JWT token         |
+| GET    | `/auth/me`                      | Current user             |
+| POST   | `/workflows`                    | Create workflow          |
+| GET    | `/workflows`                    | List user workflows      |
+| GET    | `/workflows/{workflow_id}`      | Get workflow details     |
+| POST   | `/workflows/{workflow_id}/start` | Plan, validate, and execute DAG |
+| GET    | `/workflows/{workflow_id}/tasks` | List workflow tasks      |
+| GET    | `/workflows/{workflow_id}/events` | List workflow events (supports `after_id`) |
+| GET    | `/workflows/{workflow_id}/events/stream` | SSE live event stream |
+| GET    | `/workflows/{workflow_id}/attempts` | List repair/execution attempts |
+| GET    | `/settings/providers`           | List LLM providers and models |
+| POST   | `/settings/api-credentials`     | Store encrypted API key  |
+| GET    | `/settings/api-credentials`     | List credentials (redacted) |
+| DELETE | `/settings/api-credentials/{id}` | Delete credential     |
+| GET    | `/health`                       | Health + DB connectivity |
+
+## Database Schema
+
+PostgreSQL tables (Phase 1):
+
+- `users` — authentication
+- `workflows` — workflow records with status and planner output
+- `tasks` — DAG task nodes (schema ready; populated in Phase 2)
+- `attempts` — generation/execution attempts
+- `events` — workflow event stream
+- `api_credentials` — encrypted user LLM API keys
+
+## LLM Provider Abstraction
+
+Providers implement:
+
+- `generate()` — text completion
+- `generate_structured()` — JSON output
+- `estimate_cost()` — token cost estimation
+
+Currently supported: **OpenAI** and **Gemini**. 
+The workflow engine resolves providers through `get_llm_provider()` — no provider-specific code in API routes. 
+
+Users can securely enter their own API keys (OpenAI or Gemini) directly in the frontend Settings page. The keys are encrypted at rest in the database and automatically injected into the containerized runner during execution.
+
+## Running Tests
+
+```bash
+# Ensure PostgreSQL is running
+docker compose up -d postgres
+
+# Run migrations (if not already applied)
+alembic upgrade head
+
+# Install dependencies and run tests
+pip install -r backend/requirements.txt
+pytest -v
+```
+
+Tests use a real PostgreSQL connection and truncate tables between test cases.
+
+## Security Considerations
+
+- Passwords stored as bcrypt hashes
+- API keys encrypted at rest (Fernet-derived key from `ENCRYPTION_KEY`)
+- JWT authentication on all workflow endpoints
+- Users cannot access other users' workflows
+- Generated code execution will run only inside Docker (Phase 2+)
+
+## Known Limitations
+
+- Docker sandbox requires Docker on the host for real code execution
+- LLM calls require a valid API key (OpenAI supported)
+- Benchmark runner not yet implemented
+
+## License
+
+See LICENSE (to be added).

AutoForge/backend/agents/__init__.py

@@ -0,0 +1 @@
+"""Agent modules — planner and task handlers."""

AutoForge/backend/agents/code_agent.py

@@ -0,0 +1,95 @@
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+
+class GeneratedFile(BaseModel):
+  path: str
+  content: str
+  language: str = "python"
+
+
+class CodeGenerationResult(BaseModel):
+  files: dict[str, dict[str, str]]
+  status: str = "generated"
+
+  @classmethod
+  def from_llm_payload(cls, payload: dict[str, Any]) -> "CodeGenerationResult":
+    files: dict[str, dict[str, str]] = {}
+    for item in payload.get("files", []):
+      path = item["path"].lstrip("/").replace("\\", "/")
+      files[path] = {
+        "content": item["content"],
+        "language": item.get("language", "python"),
+      }
+    if not files:
+      raise ValueError("Code generation produced no files")
+    return cls(files=files)
+
+
+CODE_GENERATION_SCHEMA: dict[str, Any] = {
+  "type": "object",
+  "properties": {
+    "files": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "path": {"type": "string"},
+          "content": {"type": "string"},
+          "language": {"type": "string"},
+        },
+        "required": ["path", "content"],
+      },
+    }
+  },
+  "required": ["files"],
+}
+
+CODE_GENERATION_SYSTEM_PROMPT = """You are a code generation agent.
+Generate a complete, runnable Python project for the user request.
+Return JSON with a files array. Each file must include path, content, and language.
+
+Requirements:
+- Use a flat or package layout that pytest can import (e.g. calculator.py or calculator/__init__.py).
+- Include requirements.txt with only third-party packages (pytest is pre-installed in the sandbox).
+- For stdlib-only projects, requirements.txt may be empty or contain only comments.
+- Do not include tests — a separate agent will generate them.
+Return only valid JSON."""
+
+
+from backend.llm.base import LLMProvider
+from backend.orchestration.errors import TaskExecutionError
+from backend.orchestration.task_context import TaskContext
+
+
+class CodeGenerationAgent:
+  def __init__(self, llm: LLMProvider) -> None:
+    self.llm = llm
+
+  async def generate(self, context: TaskContext) -> dict[str, Any]:
+    prompt = (
+      f"User request:\n{context.user_prompt}\n\n"
+      "Generate the implementation files for this project."
+    )
+    try:
+      structured = await self.llm.generate_structured(
+        prompt,
+        schema=CODE_GENERATION_SCHEMA,
+        system_prompt=CODE_GENERATION_SYSTEM_PROMPT,
+        temperature=0.2,
+      )
+      result = CodeGenerationResult.from_llm_payload(structured)
+      return result.model_dump()
+    except ValueError as exc:
+      raise TaskExecutionError(str(exc), error_type="CODE_GENERATION_ERROR") from exc
+    except Exception as exc:
+      raise TaskExecutionError(
+        f"Code generation failed: {exc}",
+        error_type="CODE_GENERATION_ERROR",
+      ) from exc
+
+
+async def run_code_generation(context: TaskContext) -> dict[str, Any]:
+  agent = CodeGenerationAgent(context.llm)
+  return await agent.generate(context)

AutoForge/backend/agents/diagnosis_agent.py

@@ -0,0 +1,81 @@
+from typing import Any
+
+from pydantic import BaseModel
+
+from backend.llm.base import LLMProvider
+from backend.orchestration.failure_classifier import ClassifiedFailure
+from backend.orchestration.task_context import TaskContext
+
+
+class DiagnosisResult(BaseModel):
+  error_type: str
+  root_cause: str
+  recommended_fix: str
+  affected_files: list[str] = []
+
+  def to_dict(self) -> dict[str, Any]:
+    return self.model_dump()
+
+
+DIAGNOSIS_SCHEMA: dict[str, Any] = {
+  "type": "object",
+  "properties": {
+    "error_type": {"type": "string"},
+    "root_cause": {"type": "string"},
+    "recommended_fix": {"type": "string"},
+    "affected_files": {"type": "array", "items": {"type": "string"}},
+  },
+  "required": ["error_type", "root_cause", "recommended_fix", "affected_files"],
+}
+
+DIAGNOSIS_SYSTEM_PROMPT = """You are a failure diagnosis agent.
+Analyze the workflow failure context and return structured JSON with root cause and fix recommendation.
+Return only valid JSON."""
+
+
+class DiagnosisAgent:
+  def __init__(self, llm: LLMProvider) -> None:
+    self.llm = llm
+
+  async def diagnose(
+    self,
+    *,
+    user_prompt: str,
+    failure: ClassifiedFailure,
+    code_files: dict[str, dict[str, str]],
+    test_files: dict[str, dict[str, str]],
+    stdout: str = "",
+    stderr: str = "",
+    previous_attempts: list[dict[str, Any]] | None = None,
+  ) -> DiagnosisResult:
+    code_listing = "\n".join(
+      f"--- {path} ---\n{meta['content']}" for path, meta in code_files.items()
+    )
+    test_listing = "\n".join(
+      f"--- {path} ---\n{meta['content']}" for path, meta in test_files.items()
+    )
+    prompt = (
+      f"User request:\n{user_prompt}\n\n"
+      f"Failure category: {failure.category.value}\n"
+      f"Failure message: {failure.message}\n"
+      f"stdout:\n{stdout}\n\nstderr:\n{stderr}\n\n"
+      f"Code files:\n{code_listing}\n\nTest files:\n{test_listing}\n\n"
+      f"Previous attempts: {len(previous_attempts or [])}\n"
+      "Diagnose the failure."
+    )
+    structured = await self.llm.generate_structured(
+      prompt,
+      schema=DIAGNOSIS_SCHEMA,
+      system_prompt=DIAGNOSIS_SYSTEM_PROMPT,
+      temperature=0.0,
+    )
+    return DiagnosisResult.model_validate(structured)
+
+
+async def stub_diagnose(failure: ClassifiedFailure) -> DiagnosisResult:
+  return DiagnosisResult(
+    error_type=failure.category.value,
+    root_cause=f"Detected {failure.category.value}: {failure.message}",
+    recommended_fix="Apply automated repair to resolve the reported failure.",
+    affected_files=[],
+  )

AutoForge/backend/agents/planner.py

@@ -0,0 +1,91 @@
+import json
+from typing import Any
+
+from backend.llm.base import LLMProvider
+from backend.orchestration.dag_schema import DAGPlan, DAGTaskDefinition, TaskType
+from backend.orchestration.errors import PlannerError
+
+PLANNER_SYSTEM_PROMPT = """You are a software workflow planner.
+Given a user coding request, produce a dependency-aware execution DAG as JSON.
+
+Rules:
+- Return ONLY valid JSON matching the schema.
+- Use unique task ids (short labels like A, B, C or descriptive ids).
+- Task types must be one of: code_generation, test_generation, static_analysis, execute.
+- Typical flow: code_generation first, then test_generation and static_analysis in parallel, then execute depending on both.
+- depends_on must list task ids that must complete before this task runs.
+- Do not create cycles.
+"""
+
+PLANNER_OUTPUT_SCHEMA: dict[str, Any] = {
+    "type": "object",
+    "properties": {
+        "tasks": {
+            "type": "array",
+            "items": {
+                "type": "object",
+                "properties": {
+                    "id": {"type": "string"},
+                    "type": {
+                        "type": "string",
+                        "enum": [t.value for t in TaskType],
+                    },
+                    "depends_on": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                    },
+                },
+                "required": ["id", "type", "depends_on"],
+            },
+        }
+    },
+    "required": ["tasks"],
+}
+
+
+class PlannerAgent:
+    """Generates a structured DAG plan from a user prompt."""
+
+    def __init__(self, llm: LLMProvider) -> None:
+        self.llm = llm
+
+    async def create_plan(self, user_prompt: str, *, context: str | None = None) -> DAGPlan:
+        prompt = user_prompt
+        if context:
+            prompt = f"Relevant context:\n{context}\n\nUser request:\n{user_prompt}"
+
+        try:
+            structured = await self.llm.generate_structured(
+                prompt,
+                schema=PLANNER_OUTPUT_SCHEMA,
+                system_prompt=PLANNER_SYSTEM_PROMPT,
+                temperature=0.0,
+            )
+            return self.parse_plan(structured)
+        except PlannerError:
+            raise
+        except Exception as exc:
+            raise PlannerError(f"Planner LLM call failed: {exc}") from exc
+
+    @staticmethod
+    def parse_plan(data: dict[str, Any]) -> DAGPlan:
+        try:
+            tasks = [
+                DAGTaskDefinition(
+                    id=task["id"],
+                    type=TaskType(task["type"]),
+                    depends_on=task.get("depends_on", []),
+                )
+                for task in data["tasks"]
+            ]
+            return DAGPlan(tasks=tasks)
+        except (KeyError, TypeError, ValueError) as exc:
+            raise PlannerError(f"Invalid planner output structure: {exc}") from exc
+
+    @staticmethod
+    def parse_plan_json(raw_json: str) -> DAGPlan:
+        try:
+            data = json.loads(raw_json)
+        except json.JSONDecodeError as exc:
+            raise PlannerError(f"Planner output is not valid JSON: {exc}") from exc
+        return PlannerAgent.parse_plan(data)

AutoForge/backend/agents/repair_agent.py

@@ -0,0 +1,101 @@
+from typing import Any
+
+from pydantic import BaseModel
+
+from backend.agents.code_agent import CodeGenerationResult
+from backend.llm.base import LLMProvider
+from backend.agents.diagnosis_agent import DiagnosisResult
+
+
+class RepairResult(BaseModel):
+  files: dict[str, dict[str, str]]
+  repair_summary: str
+  status: str = "repaired"
+
+  def to_dict(self) -> dict[str, Any]:
+    return {
+      "files": self.files,
+      "repair_summary": self.repair_summary,
+      "status": self.status,
+    }
+
+
+REPAIR_SCHEMA: dict[str, Any] = {
+  "type": "object",
+  "properties": {
+    "files": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "path": {"type": "string"},
+          "content": {"type": "string"},
+          "language": {"type": "string"},
+        },
+        "required": ["path", "content"],
+      },
+    },
+    "repair_summary": {"type": "string"},
+  },
+  "required": ["files", "repair_summary"],
+}
+
+REPAIR_SYSTEM_PROMPT = """You are a code repair agent.
+Given the diagnosis and current project files, produce repaired files as JSON.
+Return only valid JSON with files array and repair_summary."""
+
+
+class RepairAgent:
+  def __init__(self, llm: LLMProvider) -> None:
+    self.llm = llm
+
+  async def repair(
+    self,
+    *,
+    user_prompt: str,
+    diagnosis: DiagnosisResult,
+    code_files: dict[str, dict[str, str]],
+    test_files: dict[str, dict[str, str]],
+  ) -> RepairResult:
+    all_files = {**code_files, **test_files}
+    listing = "\n".join(
+      f"--- {path} ---\n{meta['content']}" for path, meta in all_files.items()
+    )
+    prompt = (
+      f"User request:\n{user_prompt}\n\n"
+      f"Diagnosis:\n{diagnosis.model_dump_json()}\n\n"
+      f"Current files:\n{listing}\n\n"
+      "Produce repaired project files."
+    )
+    structured = await self.llm.generate_structured(
+      prompt,
+      schema=REPAIR_SCHEMA,
+      system_prompt=REPAIR_SYSTEM_PROMPT,
+      temperature=0.1,
+    )
+    generated = CodeGenerationResult.from_llm_payload(structured)
+    return RepairResult(
+      files=generated.files,
+      repair_summary=structured.get("repair_summary", "Repaired project files"),
+    )
+
+
+def stub_repair(
+  code_files: dict[str, dict[str, str]],
+  test_files: dict[str, dict[str, str]],
+  *,
+  fix_code: bool = True,
+) -> RepairResult:
+  """Stub repair that fixes a common broken add() implementation for tests."""
+  files = {**code_files, **test_files}
+  if fix_code and "main.py" in files:
+    content = files["main.py"]["content"]
+    if "return a - b" in content or "return a+b-1" in content:
+      files["main.py"] = {
+        **files["main.py"],
+        "content": "def add(a, b):\n    return a + b\n",
+      }
+  return RepairResult(
+    files=files,
+    repair_summary="Stub repair applied",
+  )

AutoForge/backend/agents/task_handlers.py

@@ -0,0 +1,101 @@
+import asyncio
+from collections.abc import Awaitable, Callable
+from typing import Any
+
+from backend.agents.code_agent import run_code_generation
+from backend.agents.test_agent import run_test_generation
+from backend.analysis.static_analyzer import StaticAnalyzer
+from backend.execution.verification import run_verification
+from backend.orchestration.dag_schema import TaskType
+from backend.orchestration.errors import TaskExecutionError
+from backend.orchestration.task_context import TaskContext
+
+TaskHandler = Callable[[TaskContext], Awaitable[dict[str, Any]]]
+
+STUB_CODE_FILES = {
+  "main.py": {
+    "content": "def add(a, b):\n    return a - b\n",
+    "language": "python",
+  },
+  "requirements.txt": {"content": "pytest\n", "language": "text"},
+}
+
+STUB_TEST_FILES = {
+  "tests/test_main.py": {
+    "content": "from main import add\n\ndef test_add():\n    assert add(1, 2) == 3\n",
+    "language": "python",
+  }
+}
+
+
+async def _handle_code_generation(context: TaskContext) -> dict[str, Any]:
+  if context.use_stubs:
+    return await _stub_handler(context, TaskType.CODE_GENERATION)
+  return await run_code_generation(context)
+
+
+async def _handle_test_generation(context: TaskContext) -> dict[str, Any]:
+  if context.use_stubs:
+    return await _stub_handler(context, TaskType.TEST_GENERATION)
+  return await run_test_generation(context)
+
+
+async def _handle_static_analysis(context: TaskContext) -> dict[str, Any]:
+  if context.use_stubs:
+    return await _stub_handler(context, TaskType.STATIC_ANALYSIS)
+  files = context.generated_files
+  if not files:
+    raise TaskExecutionError(
+      "No generated code available for static analysis",
+      error_type="STATIC_ANALYSIS_ERROR",
+    )
+  analyzer = StaticAnalyzer()
+  result = analyzer.analyze_files(files)
+  if result.status == "FAIL":
+    raise TaskExecutionError(
+      "Static analysis failed",
+      error_type="STATIC_ANALYSIS_ERROR",
+    )
+  return result.to_dict()
+
+
+async def _handle_execute(context: TaskContext) -> dict[str, Any]:
+  if context.use_stubs and not context.stub_execute_calls_docker:
+    return await _stub_handler(context, TaskType.EXECUTE)
+  return await run_verification(context)
+
+
+async def _stub_handler(context: TaskContext, task_type: TaskType) -> dict[str, Any]:
+  await asyncio.sleep(context.stub_delay)
+  if context.fail_task == task_type.value:
+    raise TaskExecutionError(
+      f"{task_type.value} failed",
+      error_type=f"{task_type.value.upper()}_ERROR",
+    )
+  if task_type == TaskType.CODE_GENERATION:
+    return {"status": "generated", "files": dict(STUB_CODE_FILES)}
+  if task_type == TaskType.TEST_GENERATION:
+    return {"status": "generated", "files": dict(STUB_TEST_FILES)}
+  if task_type == TaskType.STATIC_ANALYSIS:
+    return {"status": "PASS", "errors": [], "warnings": []}
+  if task_type == TaskType.EXECUTE:
+    return {"status": "PASS", "stdout": "", "stderr": "", "exit_code": 0}
+  return {"status": "planned", "files": {}, "task_type": task_type.value}
+
+
+TASK_HANDLERS: dict[TaskType, TaskHandler] = {
+  TaskType.CODE_GENERATION: _handle_code_generation,
+  TaskType.TEST_GENERATION: _handle_test_generation,
+  TaskType.STATIC_ANALYSIS: _handle_static_analysis,
+  TaskType.EXECUTE: _handle_execute,
+}
+
+
+def get_task_handler(task_type: TaskType) -> TaskHandler:
+  handler = TASK_HANDLERS.get(task_type)
+  if handler is None:
+    raise TaskExecutionError(
+      f"No handler registered for task type '{task_type}'",
+      error_type="TASK_EXECUTION_ERROR",
+    )
+  return handler

AutoForge/backend/agents/test_agent.py

@@ -0,0 +1,94 @@
+from typing import Any
+
+from pydantic import BaseModel
+
+from backend.llm.base import LLMProvider
+from backend.orchestration.errors import TaskExecutionError
+from backend.orchestration.task_context import TaskContext
+
+
+class TestGenerationResult(BaseModel):
+  files: dict[str, dict[str, str]]
+  status: str = "generated"
+
+  @classmethod
+  def from_llm_payload(cls, payload: dict[str, Any]) -> "TestGenerationResult":
+    files: dict[str, dict[str, str]] = {}
+    for item in payload.get("files", []):
+      path = item["path"].lstrip("/").replace("\\", "/")
+      files[path] = {
+        "content": item["content"],
+        "language": item.get("language", "python"),
+      }
+    if not files:
+      raise ValueError("Test generation produced no files")
+    return cls(files=files)
+
+
+TEST_GENERATION_SCHEMA: dict[str, Any] = {
+  "type": "object",
+  "properties": {
+    "files": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "path": {"type": "string"},
+          "content": {"type": "string"},
+          "language": {"type": "string"},
+        },
+        "required": ["path", "content"],
+      },
+    }
+  },
+  "required": ["files"],
+}
+
+TEST_GENERATION_SYSTEM_PROMPT = """You are a test generation agent.
+Given generated source code, produce pytest test files.
+Return JSON with a files array (paths under tests/).
+Do not modify implementation files.
+Return only valid JSON."""
+
+
+class TestGenerationAgent:
+  def __init__(self, llm: LLMProvider) -> None:
+    self.llm = llm
+
+  async def generate(self, context: TaskContext) -> dict[str, Any]:
+    code_files = context.generated_files
+    if not code_files:
+      raise TaskExecutionError(
+        "No generated code available for test generation",
+        error_type="TEST_GENERATION_ERROR",
+      )
+
+    file_listing = "\n\n".join(
+      f"--- {path} ---\n{meta['content']}" for path, meta in code_files.items()
+    )
+    prompt = (
+      f"User request:\n{context.user_prompt}\n\n"
+      f"Generated source files:\n{file_listing}\n\n"
+      "Generate pytest tests for the implementation."
+    )
+    try:
+      structured = await self.llm.generate_structured(
+        prompt,
+        schema=TEST_GENERATION_SCHEMA,
+        system_prompt=TEST_GENERATION_SYSTEM_PROMPT,
+        temperature=0.2,
+      )
+      result = TestGenerationResult.from_llm_payload(structured)
+      return result.model_dump()
+    except ValueError as exc:
+      raise TaskExecutionError(str(exc), error_type="TEST_GENERATION_ERROR") from exc
+    except Exception as exc:
+      raise TaskExecutionError(
+        f"Test generation failed: {exc}",
+        error_type="TEST_GENERATION_ERROR",
+      ) from exc
+
+
+async def run_test_generation(context: TaskContext) -> dict[str, Any]:
+  agent = TestGenerationAgent(context.llm)
+  return await agent.generate(context)

AutoForge/backend/analysis/__init__.py

@@ -0,0 +1 @@
+"""Static analysis — implemented in Phase 2+."""

AutoForge/backend/analysis/static_analyzer.py

@@ -0,0 +1,110 @@
+import ast
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from backend.orchestration.errors import TaskExecutionError
+from backend.orchestration.task_context import TaskContext
+
+
+@dataclass
+class AnalysisIssue:
+  file: str
+  line: int
+  message: str
+
+
+@dataclass
+class StaticAnalysisResult:
+  status: str
+  errors: list[dict[str, Any]] = field(default_factory=list)
+  warnings: list[dict[str, Any]] = field(default_factory=list)
+
+  def to_dict(self) -> dict[str, Any]:
+    return {
+      "status": self.status,
+      "errors": self.errors,
+      "warnings": self.warnings,
+    }
+
+
+class StaticAnalyzer:
+  """Analyze generated Python files without executing them."""
+
+  def analyze_files(self, files: dict[str, dict[str, str]]) -> StaticAnalysisResult:
+    errors: list[dict[str, Any]] = []
+    warnings: list[dict[str, Any]] = []
+
+    python_files = {
+      path: meta["content"]
+      for path, meta in files.items()
+      if path.endswith(".py")
+    }
+
+    if not python_files:
+      errors.append(
+        {"file": "", "line": 0, "message": "No Python source files found to analyze"}
+      )
+      return StaticAnalysisResult(status="FAIL", errors=errors, warnings=warnings)
+
+    for path, content in python_files.items():
+      syntax_issues = self._check_syntax(path, content)
+      errors.extend(syntax_issues)
+      warnings.extend(self._check_imports(path, content))
+
+    status = "FAIL" if errors else "PASS"
+    return StaticAnalysisResult(status=status, errors=errors, warnings=warnings)
+
+  def _check_syntax(self, path: str, content: str) -> list[dict[str, Any]]:
+    try:
+      ast.parse(content, filename=path)
+      return []
+    except SyntaxError as exc:
+      return [
+        {
+          "file": path,
+          "line": exc.lineno or 0,
+          "message": f"Syntax error: {exc.msg}",
+        }
+      ]
+
+  def _check_imports(self, path: str, content: str) -> list[dict[str, Any]]:
+    warnings: list[dict[str, Any]] = []
+    for line_no, line in enumerate(content.splitlines(), start=1):
+      stripped = line.strip()
+      if stripped.startswith("import ") or stripped.startswith("from "):
+        if re.search(r"\b(os\.system|subprocess\.|eval\(|exec\()", stripped):
+          warnings.append(
+            {
+              "file": path,
+              "line": line_no,
+              "message": "Suspicious import or call pattern detected",
+            }
+          )
+    return warnings
+
+
+async def run_static_analysis(context: TaskContext) -> dict[str, Any]:
+  files = context.all_project_files
+  if not files:
+    raise TaskExecutionError(
+      "No generated files available for static analysis",
+      error_type="STATIC_ANALYSIS_ERROR",
+    )
+  analyzer = StaticAnalyzer()
+  result = analyzer.analyze_files(files)
+  if result.status == "FAIL":
+    raise TaskExecutionError(
+      "Static analysis failed",
+      error_type="STATIC_ANALYSIS_ERROR",
+    )
+  return result.to_dict()
+
+
+def analyze_workspace(workspace: Path) -> StaticAnalysisResult:
+  files: dict[str, dict[str, str]] = {}
+  for path in workspace.rglob("*.py"):
+    relative = path.relative_to(workspace).as_posix()
+    files[relative] = {"content": path.read_text(encoding="utf-8"), "language": "python"}
+  return StaticAnalyzer().analyze_files(files)

AutoForge/backend/api/auth.py

@@ -0,0 +1,50 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from backend.api.schemas import LoginRequest, SignupRequest, TokenResponse, UserResponse
+from backend.core.dependencies import get_current_user, get_repository
+from backend.core.security import create_access_token, hash_password, verify_password
+from backend.db.models import User
+from backend.memory.workflow_repository import WorkflowRepository
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/signup", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
+async def signup(
+    payload: SignupRequest,
+    repo: WorkflowRepository = Depends(get_repository),
+) -> User:
+    if await repo.get_user_by_email(payload.email):
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Email already registered")
+    if await repo.get_user_by_username(payload.username):
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Username already taken"
+        )
+
+    user = await repo.create_user(
+        email=payload.email,
+        username=payload.username,
+        password_hash=hash_password(payload.password),
+    )
+    return user
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(
+    payload: LoginRequest,
+    repo: WorkflowRepository = Depends(get_repository),
+) -> TokenResponse:
+    user = await repo.get_user_by_email(payload.email)
+    if user is None or not verify_password(payload.password, user.password_hash):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid email or password",
+        )
+
+    token = create_access_token(str(user.id))
+    return TokenResponse(access_token=token)
+
+
+@router.get("/me", response_model=UserResponse)
+async def me(current_user: User = Depends(get_current_user)) -> User:
+    return current_user

AutoForge/backend/api/providers.py

@@ -0,0 +1,36 @@
+from fastapi import APIRouter
+
+from backend.api.schemas import ProviderInfo, ProviderListResponse
+from backend.llm.providers import list_supported_providers
+
+router = APIRouter(prefix="/settings", tags=["settings"])
+
+OPENAI_MODELS = [
+    "gpt-4o",
+    "gpt-4o-mini",
+    "gpt-4.1",
+    "gpt-4.1-mini",
+]
+
+GEMINI_MODELS = [
+    "gemini-3.1-pro",
+    "gemini-3.1-flash",
+]
+
+PROVIDER_MODELS: dict[str, list[str]] = {
+    "openai": OPENAI_MODELS,
+    "gemini": GEMINI_MODELS,
+}
+
+
+@router.get("/providers", response_model=ProviderListResponse)
+async def list_providers() -> ProviderListResponse:
+    providers = [
+        ProviderInfo(
+            id=provider_id,
+            name=provider_id.replace("_", " ").title(),
+            models=PROVIDER_MODELS.get(provider_id, []),
+        )
+        for provider_id in list_supported_providers()
+    ]
+    return ProviderListResponse(providers=providers)

AutoForge/backend/api/schemas.py

@@ -0,0 +1,146 @@
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, EmailStr, Field
+
+
+class SignupRequest(BaseModel):
+    email: EmailStr
+    username: str = Field(min_length=3, max_length=100)
+    password: str = Field(min_length=8, max_length=128)
+
+
+class LoginRequest(BaseModel):
+    email: EmailStr
+    password: str
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+
+
+class UserResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    email: str
+    username: str
+    created_at: datetime
+
+
+class WorkflowCreateRequest(BaseModel):
+    user_prompt: str = Field(min_length=1)
+    llm_provider: str = Field(min_length=1, max_length=64)
+    llm_model: str = Field(min_length=1, max_length=128)
+    api_key: str | None = Field(default=None, min_length=1)
+
+
+class WorkflowResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    workflow_id: str
+    user_prompt: str
+    status: str
+    llm_provider: str | None
+    llm_model: str | None
+    planner_output: dict | None
+    created_at: datetime
+    completed_at: datetime | None
+
+
+class WorkflowListResponse(BaseModel):
+    workflows: list[WorkflowResponse]
+    total: int
+
+
+class ApiCredentialCreateRequest(BaseModel):
+    provider: str = Field(min_length=1, max_length=64)
+    api_key: str = Field(min_length=1)
+
+
+class ApiCredentialResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    provider: str
+    api_key_hint: str
+    created_at: datetime
+    updated_at: datetime
+
+
+class HealthResponse(BaseModel):
+    status: str
+    database: str
+
+
+class TaskResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    task_key: str
+    task_type: str
+    status: str
+    depends_on: list[str] | None
+    output: dict | None
+    started_at: datetime | None
+    completed_at: datetime | None
+
+
+class TaskListResponse(BaseModel):
+    tasks: list[TaskResponse]
+    total: int
+
+
+class EventResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True, populate_by_name=True)
+
+    id: int
+    event_type: str
+    message: str
+    task_id: int | None
+    metadata: dict | None = Field(default=None, validation_alias="event_metadata")
+    timestamp: datetime
+
+
+class AttemptResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    task_id: int | None
+    attempt_number: int
+    generated_code: dict | None
+    generated_tests: dict | None
+    static_analysis_result: dict | None
+    stdout: str | None
+    stderr: str | None
+    exit_code: int | None
+    result: str | None
+    error: dict | None
+    created_at: datetime
+
+
+class AttemptListResponse(BaseModel):
+    attempts: list[AttemptResponse]
+    total: int
+
+
+class WorkflowStartRequest(BaseModel):
+    api_key: str | None = Field(default=None, min_length=1)
+
+
+class ProviderInfo(BaseModel):
+    id: str
+    name: str
+    models: list[str]
+
+
+class ProviderListResponse(BaseModel):
+    providers: list[ProviderInfo]
+
+
+class EventListResponse(BaseModel):
+    events: list[EventResponse]
+    total: int
+
+
+class WorkflowStartResponse(WorkflowResponse):
+    pass

AutoForge/backend/api/settings.py

@@ -0,0 +1,73 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import select
+
+from backend.api.schemas import ApiCredentialCreateRequest, ApiCredentialResponse
+from backend.core.dependencies import get_current_user, get_repository
+from backend.core.encryption import encrypt_value, redact_secret
+from backend.db.models import ApiCredential, User
+from backend.db.session import get_db
+from sqlalchemy.ext.asyncio import AsyncSession
+
+router = APIRouter(prefix="/settings/api-credentials", tags=["settings"])
+
+
+@router.post("", response_model=ApiCredentialResponse, status_code=status.HTTP_201_CREATED)
+async def create_api_credential(
+    payload: ApiCredentialCreateRequest,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> ApiCredentialResponse:
+    credential = ApiCredential(
+        user_id=current_user.id,
+        provider=payload.provider.lower().strip(),
+        encrypted_api_key=encrypt_value(payload.api_key),
+    )
+    db.add(credential)
+    await db.flush()
+    await db.refresh(credential)
+    return ApiCredentialResponse(
+        id=credential.id,
+        provider=credential.provider,
+        api_key_hint=redact_secret(payload.api_key),
+        created_at=credential.created_at,
+        updated_at=credential.updated_at,
+    )
+
+
+@router.get("", response_model=list[ApiCredentialResponse])
+async def list_api_credentials(
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> list[ApiCredentialResponse]:
+    result = await db.execute(
+        select(ApiCredential).where(ApiCredential.user_id == current_user.id)
+    )
+    credentials = result.scalars().all()
+    return [
+        ApiCredentialResponse(
+            id=cred.id,
+            provider=cred.provider,
+            api_key_hint="********",
+            created_at=cred.created_at,
+            updated_at=cred.updated_at,
+        )
+        for cred in credentials
+    ]
+
+
+@router.delete("/{credential_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_api_credential(
+    credential_id: int,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> None:
+    result = await db.execute(
+        select(ApiCredential).where(
+            ApiCredential.id == credential_id,
+            ApiCredential.user_id == current_user.id,
+        )
+    )
+    credential = result.scalar_one_or_none()
+    if credential is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Credential not found")
+    await db.delete(credential)

AutoForge/backend/api/workflows.py

@@ -0,0 +1,370 @@
+import asyncio
+import json
+import logging
+
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query, status
+from fastapi.responses import StreamingResponse
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from backend.api.schemas import (
+    AttemptListResponse,
+    AttemptResponse,
+    EventListResponse,
+    EventResponse,
+    TaskListResponse,
+    TaskResponse,
+    WorkflowCreateRequest,
+    WorkflowListResponse,
+    WorkflowResponse,
+    WorkflowStartRequest,
+    WorkflowStartResponse,
+)
+from backend.core.dependencies import get_current_user, get_repository
+from backend.core.encryption import decrypt_value
+from backend.core.security import decode_access_token
+from backend.db.models import ApiCredential, Attempt, Event, User, Workflow, WorkflowStatus
+from backend.db.session import AsyncSessionLocal, get_db
+from backend.events.publisher import EventPublisher
+from backend.llm.providers import get_llm_provider
+from backend.memory.workflow_repository import WorkflowRepository
+from backend.orchestration.workflow_runner import WorkflowRunner
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/workflows", tags=["workflows"])
+
+TERMINAL_WORKFLOW_STATUSES = {
+    WorkflowStatus.SUCCESS,
+    WorkflowStatus.FAILED,
+    WorkflowStatus.CANCELLED,
+}
+
+
+def _to_workflow_response(workflow) -> WorkflowResponse:
+    return WorkflowResponse(
+        workflow_id=workflow.workflow_id,
+        user_prompt=workflow.user_prompt,
+        status=workflow.status,
+        llm_provider=workflow.llm_provider,
+        llm_model=workflow.llm_model,
+        planner_output=workflow.planner_output,
+        created_at=workflow.created_at,
+        completed_at=workflow.completed_at,
+    )
+
+
+async def _resolve_api_key(
+    db: AsyncSession,
+    user_id: int,
+    provider: str,
+    request_api_key: str | None,
+) -> str:
+    if request_api_key:
+        return request_api_key
+
+    result = await db.execute(
+        select(ApiCredential).where(
+            ApiCredential.user_id == user_id,
+            ApiCredential.provider == provider.lower().strip(),
+        )
+    )
+    credential = result.scalar_one_or_none()
+    if credential is None:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="API key required. Provide api_key or store credentials in settings.",
+        )
+    return decrypt_value(credential.encrypted_api_key)
+
+
+async def _execute_workflow_background(
+    workflow_id: str,
+    user_id: int,
+    api_key: str | None,
+) -> None:
+    async with AsyncSessionLocal() as db:
+        try:
+            repo = WorkflowRepository(db)
+            workflow = await repo.get_workflow_by_public_id(workflow_id, user_id)
+            if workflow is None:
+                return
+            llm = get_llm_provider(
+                workflow.llm_provider,
+                api_key=api_key,
+                model=workflow.llm_model,
+            )
+            import shutil
+
+            has_docker = shutil.which("docker") is not None
+            if not has_docker:
+                raise RuntimeError("DOCKER_UNAVAILABLE: Sandbox unavailable — Docker is required to execute generated code.")
+
+            runner = WorkflowRunner(db)
+            await runner.run(workflow, llm)
+            await db.commit()
+        except Exception as exc:
+            logger.exception("Background workflow execution failed for %s", workflow_id)
+            await db.rollback()
+            try:
+                repo = WorkflowRepository(db)
+                workflow = await repo.get_workflow_by_public_id(workflow_id, user_id)
+                if workflow and workflow.status == WorkflowStatus.RUNNING:
+                    runner = WorkflowRunner(db)
+                    await runner._fail_workflow(
+                        workflow,
+                        message=str(exc),
+                        error_type="WORKFLOW_EXECUTION_ERROR",
+                    )
+                    await db.commit()
+            except Exception:
+                logger.exception("Failed to mark workflow %s as failed", workflow_id)
+                await db.rollback()
+
+
+@router.post("", response_model=WorkflowResponse, status_code=status.HTTP_201_CREATED)
+async def create_workflow(
+    payload: WorkflowCreateRequest,
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+    db: AsyncSession = Depends(get_db),
+) -> WorkflowResponse:
+    workflow = await repo.create_workflow(
+        user_id=current_user.id,
+        user_prompt=payload.user_prompt,
+        llm_provider=payload.llm_provider,
+        llm_model=payload.llm_model,
+    )
+    if payload.api_key:
+        existing = await db.execute(
+            select(ApiCredential).where(
+                ApiCredential.user_id == current_user.id,
+                ApiCredential.provider == payload.llm_provider.lower().strip(),
+            )
+        )
+        if existing.scalar_one_or_none() is None:
+            from backend.core.encryption import encrypt_value
+
+            db.add(
+                ApiCredential(
+                    user_id=current_user.id,
+                    provider=payload.llm_provider.lower().strip(),
+                    encrypted_api_key=encrypt_value(payload.api_key),
+                )
+            )
+    return _to_workflow_response(workflow)
+
+
+@router.post("/{workflow_id}/start", response_model=WorkflowStartResponse, status_code=status.HTTP_202_ACCEPTED)
+async def start_workflow(
+    workflow_id: str,
+    payload: WorkflowStartRequest,
+    background_tasks: BackgroundTasks,
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+    db: AsyncSession = Depends(get_db),
+) -> WorkflowStartResponse:
+    workflow = await repo.get_workflow_by_public_id(workflow_id, current_user.id)
+    if workflow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Workflow not found")
+    if workflow.status not in {WorkflowStatus.CREATED, WorkflowStatus.FAILED}:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=f"Workflow cannot be started from status {workflow.status}",
+        )
+    if not workflow.llm_provider or not workflow.llm_model:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Workflow is missing LLM provider configuration",
+        )
+
+    resolved_key = await _resolve_api_key(
+        db,
+        current_user.id,
+        workflow.llm_provider,
+        payload.api_key,
+    )
+
+    workflow.status = WorkflowStatus.RUNNING
+    await db.flush()
+
+    background_tasks.add_task(
+        _execute_workflow_background,
+        workflow_id,
+        current_user.id,
+        resolved_key,
+    )
+    return _to_workflow_response(workflow)
+
+
+@router.get("", response_model=WorkflowListResponse)
+async def list_workflows(
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+) -> WorkflowListResponse:
+    workflows = await repo.list_workflows_for_user(current_user.id)
+    items = [_to_workflow_response(wf) for wf in workflows]
+    return WorkflowListResponse(workflows=items, total=len(items))
+
+
+@router.get("/{workflow_id}", response_model=WorkflowResponse)
+async def get_workflow(
+    workflow_id: str,
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+) -> WorkflowResponse:
+    workflow = await repo.get_workflow_by_public_id(workflow_id, current_user.id)
+    if workflow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Workflow not found")
+    return _to_workflow_response(workflow)
+
+
+@router.get("/{workflow_id}/tasks", response_model=TaskListResponse)
+async def list_workflow_tasks(
+    workflow_id: str,
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+    db: AsyncSession = Depends(get_db),
+) -> TaskListResponse:
+    from backend.memory.task_repository import TaskRepository
+
+    workflow = await repo.get_workflow_by_public_id(workflow_id, current_user.id)
+    if workflow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Workflow not found")
+
+    tasks = await TaskRepository(db).get_tasks_for_workflow(workflow.id)
+    items = [
+        TaskResponse(
+            task_key=task.task_key,
+            task_type=task.task_type,
+            status=task.status,
+            depends_on=task.depends_on,
+            output=task.output,
+            started_at=task.started_at,
+            completed_at=task.completed_at,
+        )
+        for task in tasks
+    ]
+    return TaskListResponse(tasks=items, total=len(items))
+
+
+@router.get("/{workflow_id}/events", response_model=EventListResponse)
+async def list_workflow_events(
+    workflow_id: str,
+    after_id: int = 0,
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+    db: AsyncSession = Depends(get_db),
+) -> EventListResponse:
+    workflow = await repo.get_workflow_by_public_id(workflow_id, current_user.id)
+    if workflow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Workflow not found")
+
+    query = (
+        select(Event)
+        .where(Event.workflow_id == workflow.id, Event.id > after_id)
+        .order_by(Event.timestamp.asc())
+    )
+    events = (await db.execute(query)).scalars().all()
+    items = [
+        EventResponse(
+            id=event.id,
+            event_type=event.event_type,
+            message=event.message,
+            task_id=event.task_id,
+            event_metadata=event.event_metadata,
+            timestamp=event.timestamp,
+        )
+        for event in events
+    ]
+    return EventListResponse(events=items, total=len(items))
+
+
+@router.get("/{workflow_id}/events/stream")
+async def stream_workflow_events(
+    workflow_id: str,
+    token: str = Query(...),
+    after_id: int = Query(0),
+    db: AsyncSession = Depends(get_db),
+):
+    user_id_str = decode_access_token(token)
+    if user_id_str is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
+    user_id = int(user_id_str)
+    repo = WorkflowRepository(db)
+    workflow = await repo.get_workflow_by_public_id(workflow_id, user_id)
+    if workflow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Workflow not found")
+
+    async def event_generator():
+        cursor = after_id
+        idle_ticks = 0
+        while True:
+            result = await db.execute(
+                select(Event)
+                .where(Event.workflow_id == workflow.id, Event.id > cursor)
+                .order_by(Event.id.asc())
+            )
+            new_events = result.scalars().all()
+            if new_events:
+                idle_ticks = 0
+                for event in new_events:
+                    cursor = event.id
+                    payload = {
+                        "id": event.id,
+                        "event_type": event.event_type,
+                        "message": event.message,
+                        "task_id": event.task_id,
+                        "metadata": event.event_metadata,
+                        "timestamp": event.timestamp.isoformat(),
+                    }
+                    yield f"data: {json.dumps(payload)}\n\n"
+            else:
+                idle_ticks += 1
+
+            wf_result = await db.execute(
+                select(Workflow.status).where(Workflow.id == workflow.id)
+            )
+            current_status = wf_result.scalar_one_or_none()
+            if current_status in TERMINAL_WORKFLOW_STATUSES and idle_ticks >= 3:
+                yield f"data: {json.dumps({'event_type': 'STREAM_END', 'message': 'Workflow finished'})}\n\n"
+                break
+            await asyncio.sleep(1)
+
+    return StreamingResponse(event_generator(), media_type="text/event-stream")
+
+
+@router.get("/{workflow_id}/attempts", response_model=AttemptListResponse)
+async def list_workflow_attempts(
+    workflow_id: str,
+    current_user: User = Depends(get_current_user),
+    repo: WorkflowRepository = Depends(get_repository),
+    db: AsyncSession = Depends(get_db),
+) -> AttemptListResponse:
+    workflow = await repo.get_workflow_by_public_id(workflow_id, current_user.id)
+    if workflow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Workflow not found")
+
+    result = await db.execute(
+        select(Attempt)
+        .where(Attempt.workflow_id == workflow.id)
+        .order_by(Attempt.attempt_number.asc(), Attempt.id.asc())
+    )
+    attempts = result.scalars().all()
+    items = [
+        AttemptResponse(
+            id=attempt.id,
+            task_id=attempt.task_id,
+            attempt_number=attempt.attempt_number,
+            generated_code=attempt.generated_code,
+            generated_tests=attempt.generated_tests,
+            static_analysis_result=attempt.static_analysis_result,
+            stdout=attempt.stdout,
+            stderr=attempt.stderr,
+            exit_code=attempt.exit_code,
+            result=attempt.result,
+            error=attempt.error,
+            created_at=attempt.created_at,
+        )
+        for attempt in attempts
+    ]
+    return AttemptListResponse(attempts=items, total=len(items))

AutoForge/backend/core/config.py

@@ -0,0 +1,41 @@
+import os
+import tempfile
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+def _default_workspace_root() -> str:
+    base = os.path.join(tempfile.gettempdir(), "autoforge", "workspaces")
+    os.makedirs(base, exist_ok=True)
+    return base
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    database_url: str = "postgresql+asyncpg://autoforge:autoforge@localhost:5432/autoforge"
+    secret_key: str = "change-me-in-production-use-a-long-random-string"
+    encryption_key: str = "change-me-32-byte-base64-fernet-key-here="
+    algorithm: str = "HS256"
+    access_token_expire_minutes: int = 60 * 24
+    log_level: str = "INFO"
+    docker_host: str = "unix:///var/run/docker.sock"
+    max_retries: int = 4
+    workspace_root: str = _default_workspace_root()
+    default_timeout: int = 300
+    cors_origins: str = "http://localhost:3000,http://localhost:5173"
+    docker_image: str = "autoforge-sandbox:3.12"
+    docker_memory_limit: str = "512m"
+    docker_cpu_limit: float = 1.0
+    docker_network_disabled: bool = True
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()

AutoForge/backend/core/dependencies.py

@@ -0,0 +1,50 @@
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from backend.core.security import decode_access_token
+from backend.db.models import User
+from backend.db.session import get_db
+from backend.memory.workflow_repository import WorkflowRepository
+
+security = HTTPBearer(auto_error=False)
+
+
+async def get_repository(db: AsyncSession = Depends(get_db)) -> WorkflowRepository:
+    return WorkflowRepository(db)
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+    repo: WorkflowRepository = Depends(get_repository),
+) -> User:
+    if credentials is None or not credentials.credentials:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not authenticated",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    user_id_str = decode_access_token(credentials.credentials)
+    if user_id_str is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    try:
+        user_id = int(user_id_str)
+    except ValueError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token subject",
+        ) from exc
+
+    user = await repo.get_user_by_id(user_id)
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="User not found",
+        )
+    return user

AutoForge/backend/core/encryption.py

@@ -0,0 +1,30 @@
+import base64
+import hashlib
+
+from cryptography.fernet import Fernet, InvalidToken
+
+from backend.core.config import get_settings
+
+
+def _fernet() -> Fernet:
+    settings = get_settings()
+    key_material = hashlib.sha256(settings.encryption_key.encode()).digest()
+    fernet_key = base64.urlsafe_b64encode(key_material)
+    return Fernet(fernet_key)
+
+
+def encrypt_value(value: str) -> str:
+    return _fernet().encrypt(value.encode()).decode()
+
+
+def decrypt_value(encrypted_value: str) -> str:
+    try:
+        return _fernet().decrypt(encrypted_value.encode()).decode()
+    except InvalidToken as exc:
+        raise ValueError("Failed to decrypt credential") from exc
+
+
+def redact_secret(value: str, visible_chars: int = 4) -> str:
+    if len(value) <= visible_chars:
+        return "*" * len(value)
+    return f"{'*' * (len(value) - visible_chars)}{value[-visible_chars:]}"

AutoForge/backend/core/security.py

@@ -0,0 +1,36 @@
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+
+from backend.core.config import get_settings
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return pwd_context.verify(plain_password, hashed_password)
+
+
+def create_access_token(subject: str, expires_delta: timedelta | None = None) -> str:
+    settings = get_settings()
+    expire = datetime.now(UTC) + (
+        expires_delta or timedelta(minutes=settings.access_token_expire_minutes)
+    )
+    payload: dict[str, Any] = {"sub": subject, "exp": expire}
+    return jwt.encode(payload, settings.secret_key, algorithm=settings.algorithm)
+
+
+def decode_access_token(token: str) -> str | None:
+    settings = get_settings()
+    try:
+        payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm])
+        subject = payload.get("sub")
+        return str(subject) if subject else None
+    except JWTError:
+        return None