[hq] refresh real-value pilot status

[FlowmemoryAI]

What changed

• Refreshes the real-value pilot HQ docs after PR [codex] Add real-value pilot HQ gate #132 merged to main.
• Records that issues [hq/security] Define release gates before real-value public-network pilot work #130 and [contracts/security] Reconcile Slither findings blocking flowchain product E2E #131 are closed by PR [codex] Add real-value pilot HQ gate #132.
• Records the current six remaining blockers as subsystem proof commands [real-value/contracts] Add pilot contracts proof command #133 through [real-value/bridge] Add pilot bridge proof command #138.
• Records HQ refresh comments posted on each subsystem issue with local worktree evidence and next integration action.

Why

The previous HQ docs were accurate before PR #132 merged, but now main contains the HQ gate scripts and the release/static-analysis blockers are closed. The current no-go state is narrower: the strict pilot gate still fails until the six dedicated subsystem proof commands land on main.

Checks run

• git diff --check
• node infra/scripts/check-unsafe-claims.mjs
• npm run flowchain:real-value-pilot:e2e -- -AllowIncomplete
• Earlier post-merge evidence recorded in docs: npm run flowchain:l1-e2e, strict npm run flowchain:real-value-pilot:e2e failing as intended, and npm run flowchain:product-e2e

Current blockers

• [real-value/contracts] Add pilot contracts proof command #133: npm run flowchain:real-value-pilot:contracts
• [real-value/bridge] Add pilot bridge proof command #138: npm run flowchain:real-value-pilot:bridge
• [real-value/runtime] Add pilot runtime proof command #134: npm run flowchain:real-value-pilot:runtime
• [real-value/wallet] Add pilot wallet proof command #136: npm run flowchain:real-value-pilot:wallet
• [real-value/control-dashboard] Add pilot control-dashboard proof command #137: npm run flowchain:real-value-pilot:control-dashboard
• [real-value/ops] Add pilot ops proof command #135: npm run flowchain:real-value-pilot:ops

The owner pilot remains no-go until those commands exist and strict npm run flowchain:real-value-pilot:e2e passes on main alongside npm run flowchain:l1-e2e.

---

HQ Required Review Metadata (2026-05-14)

Allowed folders touched:

• docs/FLOWCHAIN_REAL_VALUE_PILOT.md
• docs/agent-runs/real-value-pilot-hq/
• infra/scripts/contracts-static-analysis.ps1
• infra/scripts/contracts-static-analysis.sh
• infra/scripts/flowchain-real-value-pilot-e2e.ps1
• package.json

Forbidden folders not touched:

• crates/
• services/
• crypto/
• contracts/
• apps/dashboard/
• hardware/
• .github/

Exact checks recorded in this PR body:

• git diff --check
• node infra/scripts/check-unsafe-claims.mjs
• npm run flowchain:real-value-pilot:e2e -- -AllowIncomplete
• earlier post-merge evidence recorded in docs: npm run flowchain:l1-e2e, strict npm run flowchain:real-value-pilot:e2e failing as intended, and npm run flowchain:product-e2e

Readiness blockers:

• Draft PR with merge state DIRTY at HQ review time; do not merge until rebased/reconciled with current main and checks are coherent.
• Strict owner-pilot readiness remains blocked by proof-command issues [real-value/contracts] Add pilot contracts proof command #133, [real-value/runtime] Add pilot runtime proof command #134, [real-value/ops] Add pilot ops proof command #135, [real-value/wallet] Add pilot wallet proof command #136, [real-value/control-dashboard] Add pilot control-dashboard proof command #137, and [real-value/bridge] Add pilot bridge proof command #138.
• Explicit Slither audit findings remain tracked in [contracts/security] Resolve explicit Slither audit findings for BaseBridgeLockbox #140 and must not be treated as formal audit/public-readiness approval.
• This PR must not be merged as real-value public-network, tokenomics, open-validator, production bridge, real-funds bridge, or audited-cryptography readiness.

[FlowmemoryAI]

HQ post-merge reconciliation after PR #141 merged to main as f384236. Verified in isolated checkout E:\FlowMemory\flowmemory-main-post141 on detached origin/main: npm ci, npm ci --prefix apps/dashboard, npm ci --prefix crypto, npm run flowchain:product-e2e, npm run flowchain:l1-e2e, npm run flowchain:real-value-pilot:e2e -- -AllowIncomplete, node infra/scripts/check-unsafe-claims.mjs, and git diff --check passed. Strict npm run flowchain:real-value-pilot:e2e still fails closed with the expected six missing proof commands (#133-#138). npm run contracts:hardening:slither still exits 1 on the known BaseBridgeLockbox.releaseNative Slither findings tracked by #140.