deps: bump all dependencies to latest major versions, require Python 3.14

.github/copilot-instructions.md

@@ -108,10 +108,13 @@ Examples: `scatter-basic`, `scatter-color-mapped`, `bar-grouped-horizontal`, `he
 
 - **`plots/{spec-id}/`**: Plot-centric directories (spec + metadata + implementations)
 - **`prompts/`**: AI agent prompts for code generation and quality evaluation
-- **`core/`**: Shared business logic (database, repositories, config)
+- **`core/`**: Shared business logic (database, repositories, config, utils, images)
   - **`core/database/types.py`**: Custom SQLAlchemy types (PostgreSQL + SQLite compatibility)
-- **`api/`**: FastAPI backend (routers, schemas, dependencies)
-- **`app/`**: React frontend (React 19 + TypeScript + Vite 7 + MUI 7)
+  - **`core/database/repositories.py`**: Data access layer
+- **`api/`**: FastAPI backend (routers, schemas, dependencies, cache, analytics, MCP server)
+- **`app/`**: React frontend (React 19 + TypeScript 5 + Vite 7 + MUI 7)
+- **`agentic/`**: AI workflow layer (composable phases, prompt templates, runtime state)
+- **`automation/`**: CI/CD helper scripts (workflow_cli, label_manager, sync_to_postgres)
 - **`tests/unit/`**: Unit tests with mocked dependencies
 - **`tests/integration/`**: Integration tests with SQLite in-memory database
 - **`tests/e2e/`**: End-to-end tests with full FastAPI stack
@@ -210,10 +213,10 @@ plt.savefig('plot.png', dpi=300, bbox_inches='tight')
 
 ## Tech Stack
 
-- **Backend**: FastAPI, SQLAlchemy (async), PostgreSQL, Python 3.10+
-- **Frontend**: React 19, TypeScript, Vite 7, MUI 7
+- **Backend**: FastAPI, SQLAlchemy (async), PostgreSQL, Python 3.12+
+- **Frontend**: React 19, TypeScript 5, Vite 7, MUI 7
 - **Package Manager**: uv (Python), yarn (Node.js)
-- **Linting**: Ruff (Python)
+- **Linting**: Ruff (Python), ESLint (TypeScript)
 
 ## Deployment
 

.serena/memories/code_style.md

@@ -1,80 +1,64 @@
 # Code Style and Conventions
 
-## Python Style (API, Core, Tests)
-- **Linter/Formatter**: Ruff (enforces PEP 8)
-- **Line Length**: 120 characters
+## Python (API, Core, Tests)
+- **Linter/Formatter**: Ruff (line-length=120, target=py312)
+- **Rules**: E, F, W, I, C, B (ignores E501, C901, B008)
+- **Excludes**: plots/, scripts/, .git, .venv, __pycache__, dist, temp
 - **Type Hints**: Required for all functions
-- **Docstrings**: Google style for all public functions
-- **Import Order**: Standard library → Third-party → Local
-
-### Example (for API/core code):
-```python
-def get_spec_by_id(spec_id: str, db: Session) -> Spec:
-    """
-    Retrieve a spec by its ID.
-
-    Args:
-        spec_id: The unique spec identifier
-        db: Database session
-
-    Returns:
-        Spec object if found
-
-    Raises:
-        NotFoundError: If spec doesn't exist
-    """
-    pass
-```
+- **Docstrings**: Google style for public functions
+- **Import Order**: stdlib → third-party → local (enforced by ruff I)
+- **Async**: SQLAlchemy async, pytest-asyncio (auto mode)
+
+## TypeScript (Frontend)
+- **Linter**: ESLint 9 with typescript-eslint
+- **Strict mode**: Enabled in tsconfig
+- **Target**: ES2020, bundler module resolution
+- **Path alias**: `@/` → `./src/`
+- **Components**: PascalCase files (e.g., `PlotCard.tsx`), function components only
+- **Hooks**: camelCase with `use` prefix (e.g., `useSpecs.ts`)
+- **Utils/Types**: camelCase files (e.g., `api.ts`)
+- **Exports**: Named exports (no default exports)
+- **Styling**: MUI `sx` prop + Emotion `styled()`, no CSS modules
+- **State**: Local state + custom hooks (no Redux/Zustand)
+- **API calls**: Plain `fetch()` in `utils/api.ts`
+
+## Agentic Layer Conventions
+- **Script headers**: uv inline script metadata (dependencies declared in-file)
+- **CLI**: Click for all workflow scripts
+- **Console output**: Rich library, stderr for UI, stdout for state JSON
+- **State**: `WorkflowState` persisted at `agentic/runs/{run_id}/state.json`
+- **Templates**: `agentic/commands/*.md` with `$1`, `$2`, `$ARGUMENTS` placeholders
+- **Execution**: `prompt_claude_code_with_retry()` in `agent.py`
+- **Data types**: `TestResult`, `ReviewResult`, `ReviewIssue` in `agent.py`
+- **JSON parsing**: `parse_json()` handles markdown-fenced JSON from LLM output
 
 ## Plot Implementation Style (KISS)
-Plot implementations should be simple, readable scripts - like matplotlib gallery examples:
-
 ```python
 """
-scatter-basic: Basic Scatter Plot
-Library: matplotlib
+spec-id: Plot Title
+Library: library-name
 """
-
 import matplotlib.pyplot as plt
 import numpy as np
 
 # Data
 np.random.seed(42)
 x = np.random.randn(100)
-y = x * 0.8 + np.random.randn(100) * 0.5
 
 # Plot
 fig, ax = plt.subplots(figsize=(16, 9))
-ax.scatter(x, y, alpha=0.7, s=50, color='#306998')
-
-ax.set_xlabel('X Value')
-ax.set_ylabel('Y Value')
-ax.set_title('Basic Scatter Plot')
-ax.grid(True, alpha=0.3)
-
+ax.scatter(x, y)
+ax.set_title('Title')
 plt.tight_layout()
 plt.savefig('plot.png', dpi=300, bbox_inches='tight')
 ```
-
-### Plot Code Rules:
-- No functions, no classes
-- No `if __name__ == '__main__':`
-- No type hints or docstrings (in plot code)
-- Just: imports → data → plot → save
+- No functions, no classes, no `if __name__`
+- No type hints or docstrings in plot code
+- Flow: imports → data → plot → save
 
 ## Naming Conventions
-
-### Spec IDs
-Format: `{plot-type}-{variant}-{modifier}` (lowercase, hyphens only)
-- `scatter-basic` - Simple 2D scatter plot
-- `bar-grouped-horizontal` - Horizontal grouped bars
-- `heatmap-correlation` - Correlation matrix heatmap
-
-### Files
-- Implementation files: `{library}.py` (e.g., `matplotlib.py`)
-- Metadata files: `{library}.yaml`
-
-## General Rules
-- Always write in English
-- Testing coverage target: 90%+
-- Test naming: `test_{what_it_does}`
+- **Spec IDs**: `{plot-type}-{variant}-{modifier}` (lowercase, hyphens)
+- **Implementation files**: `{library}.py`
+- **Metadata files**: `{library}.yaml`
+- **Test naming**: `test_{what_it_does}`
+- **All output**: English only (comments, commits, docs, PRs)

.serena/memories/commands.md

@@ -0,0 +1,87 @@
+# Commands Reference
+
+## Development Setup
+```bash
+uv sync --all-extras                    # Install Python dependencies
+cd app && yarn install                  # Install frontend dependencies
+uv run alembic upgrade head             # Run DB migrations
+```
+
+## Running Services
+```bash
+uv run uvicorn api.main:app --reload --port 8000   # Backend API
+cd app && yarn dev                                   # Frontend dev server
+docker-compose up                                    # All services
+```
+
+## Code Quality (REQUIRED before commits)
+```bash
+uv run ruff check <files>              # Lint check
+uv run ruff check <files> --fix        # Auto-fix lint
+uv run ruff format <files>             # Format code
+cd app && yarn lint                    # Frontend lint
+```
+
+## Testing
+```bash
+uv run pytest                          # All tests
+uv run pytest tests/unit               # Unit tests only
+uv run pytest tests/integration        # Integration tests
+uv run pytest --cov=. --cov-report=html  # With coverage
+uv run pytest tests/unit/api/test_routers.py::test_name  # Specific test
+```
+
+## Database
+```bash
+uv run alembic upgrade head            # Apply migrations
+uv run alembic revision --autogenerate -m "description"  # Create migration
+uv run alembic current                 # Check current revision
+```
+
+## Frontend
+```bash
+cd app && yarn dev                     # Dev server
+cd app && yarn build                   # Production build (tsc + vite)
+cd app && yarn preview                 # Preview prod build
+cd app && yarn lint                    # ESLint check
+cd app && yarn type-check              # TypeScript type check only
+cd app && yarn test                    # Run vitest
+cd app && yarn test:watch              # Watch mode tests
+```
+
+## Agentic Workflows
+```bash
+# Individual phases (all use Click CLI)
+uv run agentic/workflows/plan.py --spec-id <id> --library <lib>
+uv run agentic/workflows/build.py --run-id <id>
+uv run agentic/workflows/test.py --run-id <id>
+uv run agentic/workflows/review.py --run-id <id>
+
+# Orchestrators
+uv run agentic/workflows/plan_build.py --spec-id <id> --library <lib>
+uv run agentic/workflows/plan_build_test.py --spec-id <id> --library <lib>
+uv run agentic/workflows/plan_build_test_review.py --spec-id <id> --library <lib>
+```
+
+## GitHub Actions (via gh CLI)
+```bash
+# Spec workflow
+gh issue create --title "Plot Name" --label "spec-request" --body "Description"
+# After review: add 'approved' label to ISSUE (not PR!)
+
+# Implementation workflow
+gh workflow run bulk-generate.yml -f specification_id=<spec-id> -f library=all
+
+# Monitor
+gh run list --workflow=impl-generate.yml
+gh run list --workflow=impl-review.yml
+gh run list --workflow=impl-merge.yml
+
+# Sync to DB
+gh workflow run sync-postgres.yml
+```
+
+## Important Notes
+- Use `uv run` for all Python commands (no system python)
+- Use `yarn` (not npm) for frontend
+- Never manually merge impl PRs - let `impl-merge.yml` handle it