After a quick analysis it seems that the only two reasons why droolsjbpm-integration repo depends on appformer are:

• kie-identity-session-provider: contains few classes to handle Session data and they are not used in this repo but only by *-wb repos so this module can be moved to appformer or more probably to kie-wb-common
• kie-security: depends on uberfire-security-backend that is a module with only a single Principal impl class (BasicAuthorizationPrincipal) and it could be moved somewhere else too (or cloned inside droolsjbpm-integration)