[hq] add full L1 agent goal launcher

docs/agent-goals/full-l1/README.md

@@ -0,0 +1,44 @@
+# FlowChain Full L1 Agent Goals
+
+Status: copy-ready long-running `/goal` prompts for building FlowChain from the
+current local deterministic devnet into a runnable private/local L1 testnet.
+
+These prompts are intentionally implementation-heavy. They are for dedicated
+Codex agents in separate worktrees. Agents must build on existing code and must
+not create replacement systems.
+
+Target local acceptance:
+
+1. A clean Windows machine can install and run FlowChain with one obvious path.
+2. At least one long-running local node produces blocks.
+3. Optional LAN or multi-process nodes can join a private testnet.
+4. Transactions can be signed, submitted, included, queried, exported, and
+   replayed deterministically.
+5. Agent, model, receipt, artifact, verifier, memory, challenge, and finality
+   lifecycle objects are real local runtime objects, not only static fixtures.
+6. The control-plane API exposes node, chain, account, transaction, bridge, and
+   object state to the workbench.
+7. The workbench shows verified live API status and can inspect or trigger the
+   local flow.
+8. A bridge POC can observe Base Sepolia or mocked Base lock events and credit
+   the local chain in a replay-safe test mode.
+9. `npm run flowchain:full-smoke` proves the whole path.
+
+Prompt files:
+
+- `chain-runtime.md`
+- `crypto-wallet.md`
+- `control-plane-indexer.md`
+- `dashboard-workbench.md`
+- `contracts-settlement.md`
+- `bridge-relayer.md`
+- `hardware-signals.md`
+- `research-consensus.md`
+- `hq-integration-review.md`
+
+Launch helper:
+
+```powershell
+cd E:\FlowMemory\flowchain-release
+powershell -ExecutionPolicy Bypass -File .\infra\scripts\launch-full-l1-agents.ps1
+```

docs/agent-goals/full-l1/bridge-relayer.md

@@ -0,0 +1,68 @@
+/goal You are the FlowChain bridge agent.
+
+You are working in `E:\FlowMemory\flowmemory-bridge-full`.
+
+Mission: build a working test bridge path so a tester can move value-like test
+events from Base Sepolia or a mock Base event into the local FlowChain runtime
+and see the credited result in the API/workbench. The default path must use
+mock or Base Sepolia test assets. Do not silently operate on real funds.
+
+Read first:
+- AGENTS.md
+- docs/bridge/FLOWCHAIN_BASE_BRIDGE_POC.md
+- services/bridge-relayer/
+- contracts/bridge/
+- schemas/flowmemory/bridge-*.schema.json
+- docs/FLOWCHAIN_FULL_PRIVATE_TESTNET.md
+
+Allowed folders:
+- services/bridge-relayer/
+- contracts/bridge/
+- tests/bridge/
+- schemas/flowmemory/bridge-*.schema.json
+- fixtures/bridge/
+- infra/scripts/bridge-*.ps1
+- package.json when adding bridge commands
+- docs/bridge/
+
+Do not edit:
+- apps/dashboard/
+- crates/flowmemory-devnet/ except documented bridge handoff examples
+- crypto/ except shared bridge schema references
+- hardware/
+
+Build requirements:
+1. Observe BaseBridgeLockbox deposit events from:
+   - committed mock fixture
+   - local Anvil
+   - Base Sepolia RPC when env vars are provided
+2. Convert deposits into canonical BridgeObservation and BridgeCredit objects
+   with replay protection and deterministic IDs.
+3. Submit bridge credits into the local FlowChain runtime through the
+   control-plane/runtime intake path once available; until then, write the
+   exact handoff file the runtime agent will consume.
+4. Add withdrawal/burn intent objects for local-to-Base testing. For now this
+   can be a test-mode withdrawal record with no real mainnet release.
+5. Add bridge smoke commands:
+   - mock bridge smoke
+   - Base Sepolia observation smoke
+   - full local credit smoke
+6. Make the workbench/API able to display deposit observed -> credit pending ->
+   credit applied -> withdrawal requested.
+
+Expected commands:
+- `npm run bridge:mock`
+- `npm run bridge:test`
+- `npm run bridge:sepolia:observe`
+- `npm run bridge:local-credit:smoke`
+- contribute to `npm run flowchain:full-smoke`
+
+Acceptance:
+- Bridge relayer tests pass.
+- Foundry bridge tests pass if contracts changed.
+- Mock deposit credits local state or writes a validated handoff.
+- Base Sepolia observation can run without private keys.
+- Any real-funds command requires an explicit flag and prints what chain, token,
+  amount, contract, and account will be used before it broadcasts.
+- `git diff --check` passes.
+- Open a PR and push your branch.

docs/agent-goals/full-l1/chain-runtime.md

@@ -0,0 +1,82 @@
+/goal You are the FlowChain full L1 runtime agent.
+
+You are working in `E:\FlowMemory\flowmemory-chain`.
+
+Mission: turn the existing Rust deterministic devnet into a runnable
+private/local L1 testnet runtime that can run on a second Windows computer. This
+must be real implementation work, not a planning-only PR.
+
+Read first:
+- AGENTS.md
+- docs/FLOWCHAIN_FULL_PRIVATE_TESTNET.md
+- docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md
+- docs/FLOWCHAIN_AGENT_INTEGRATION_MAP.md
+- docs/LOCAL_DEVNET.md
+- crates/flowmemory-devnet/
+- infra/scripts/flowchain-*.ps1
+
+Allowed folders:
+- crates/flowmemory-devnet/
+- devnet/
+- infra/scripts/
+- package.json and package-lock.json when adding root commands
+- docs/LOCAL_DEVNET.md
+- docs/FLOWCHAIN_SECOND_COMPUTER_SETUP.md
+- docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md only for acceptance evidence
+
+Do not edit:
+- apps/dashboard/
+- services/ except documented handoff files if strictly necessary
+- contracts/
+- crypto/
+- hardware/
+
+Build requirements:
+1. Add a long-running node mode to the Rust devnet. It must keep state on disk,
+   accept local transactions, produce blocks on an interval or manual tick, and
+   expose useful logs.
+2. Add a transaction intake path for FlowChain-native objects:
+   AgentAccount, ModelPassport, WorkReceipt, ArtifactAvailabilityProof,
+   VerifierModule, VerifierReport, MemoryCell, Challenge, FinalityReceipt, and
+   local balance/faucet records.
+3. Add a local account/balance ledger for test units only. This is not
+   tokenomics; it is necessary so the test chain can send transactions and
+   bridge credits.
+4. Add a minimal node identity and peer model. At minimum support multi-process
+   local nodes with static peer config and deterministic block/state sync. LAN
+   mode can be simple, but it must be documented and smoke-tested if exposed.
+5. Add CLI commands and npm wrappers for:
+   - start node
+   - stop node
+   - node status
+   - submit transaction
+   - faucet local account
+   - run one-node smoke
+   - run two-node or multi-process smoke
+   - export/import runtime state
+6. Keep the existing deterministic fixture/demo path working.
+7. Feed handoff outputs to the existing control-plane and dashboard surfaces.
+
+Expected commands to add or make work:
+- `npm run flowchain:node`
+- `npm run flowchain:node:stop`
+- `npm run flowchain:tx`
+- `npm run flowchain:faucet`
+- `npm run flowchain:node:smoke`
+- `npm run flowchain:multi-node:smoke`
+- contribute to `npm run flowchain:full-smoke`
+
+Acceptance:
+- `cargo test --manifest-path crates/flowmemory-devnet/Cargo.toml` passes.
+- A local node can run for at least 10 blocks.
+- A signed or locally authorized transaction can be submitted and included.
+- State survives restart.
+- Export/import still works.
+- Multi-process smoke either passes or clearly marks LAN mode as not yet exposed
+  while still proving two local nodes can exchange or reconcile state.
+- `git diff --check` passes.
+- Open a PR and push your branch.
+
+Do not stop because part of this is difficult. If full networking is too large
+for one pass, build the smallest real local multi-process version and leave a
+failing/skip-marked test naming the exact remaining gap.

docs/agent-goals/full-l1/contracts-settlement.md

@@ -0,0 +1,54 @@
+/goal You are the FlowChain contracts and settlement-spine agent.
+
+You are working in `E:\FlowMemory\flowmemory-contracts`.
+
+Mission: build the contract-side pieces that support the local/private L1 and
+bridge test flow. Contracts are not the whole L1 runtime; they are the optional
+settlement/event/bridge spine for testing. Build concrete Solidity and Foundry
+tests, not just docs.
+
+Read first:
+- AGENTS.md
+- contracts/
+- tests/
+- docs/FLOWCHAIN_FULL_PRIVATE_TESTNET.md
+- docs/bridge/FLOWCHAIN_BASE_BRIDGE_POC.md
+
+Allowed folders:
+- contracts/
+- tests/
+- script/ if Foundry scripts are needed
+- foundry.toml
+- docs/bridge/ for contract boundary notes
+
+Do not edit:
+- services/
+- apps/
+- crates/
+- crypto/
+- hardware/
+
+Build requirements:
+1. Harden and extend BaseBridgeLockbox for test bridge flows:
+   deposits, replay protection, token allowlist, pause, per-deposit cap,
+   deterministic event shape, and withdrawal/release test hooks where needed.
+2. Add or refine local settlement contracts/events for FlowChain object
+   commitments where they help indexer/verifier and bridge agents.
+3. Keep contracts compact. Do not try to implement the whole runtime in
+   Solidity.
+4. Add Foundry tests for all bridge and settlement edge cases.
+5. Add Anvil/Base Sepolia script paths for testing, with explicit environment
+   variables and dry-run by default.
+
+Expected commands:
+- `forge test`
+- `npm run contracts:hardening`
+- bridge-specific Foundry tests
+
+Acceptance:
+- Foundry tests pass.
+- Bridge event schema is stable and documented for the bridge relayer.
+- No contract can accidentally release or mint without explicit test-only
+  authority.
+- `git diff --check` passes.
+- Open a PR and push your branch.

docs/agent-goals/full-l1/control-plane-indexer.md

@@ -0,0 +1,64 @@
+/goal You are the FlowChain control-plane, indexer, and verifier API agent.
+
+You are working in `E:\FlowMemory\flowmemory-indexer`.
+
+Mission: make the local node queryable and usable. Extend the existing
+`services/` packages into the API layer for the private/local L1 testnet. This
+must support live node state, submitted transactions, bridge observations, and
+the full object lifecycle. Do not create a second API framework.
+
+Read first:
+- AGENTS.md
+- docs/FLOWCHAIN_CONTROL_PLANE_API.md
+- docs/FLOWCHAIN_FULL_PRIVATE_TESTNET.md
+- docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md
+- services/control-plane/
+- services/indexer/
+- services/verifier/
+- services/bridge-relayer/
+
+Allowed folders:
+- services/
+- fixtures/ when generated service fixtures are needed
+- schemas/flowmemory/ only when coordinating response schemas
+- package.json and package-lock.json when adding commands
+- docs/FLOWCHAIN_CONTROL_PLANE_API.md
+- docs/INDEXER_VERIFIER_MVP.md
+
+Do not edit:
+- apps/dashboard/
+- contracts/
+- crates/flowmemory-devnet/ except documented API handoff examples
+- crypto/ except schema references
+- hardware/
+
+Build requirements:
+1. Keep `/health`, `/state`, `/rpc`, and CORS working for the browser.
+2. Add live local-node adapters so the API reads current runtime state from
+   `devnet/local/` or the node API, not only committed fixtures.
+3. Add JSON-RPC and HTTP helpers for:
+   node status, peers, blocks, transactions, mempool, accounts, balances,
+   faucet events, wallet public metadata, AgentAccount, ModelPassport,
+   WorkReceipt, ArtifactAvailabilityProof, VerifierModule, VerifierReport,
+   MemoryCell, Challenge, FinalityReceipt, bridge deposits, bridge credits, and
+   withdrawals.
+4. Add transaction submission endpoint that forwards signed/local test
+   transactions to the runtime agent's intake path.
+5. Add bridge observation intake/read endpoints for the bridge agent.
+6. Add full smoke client coverage that queries every lifecycle object.
+7. Add no-secret response scanning.
+
+Expected commands:
+- `npm run control-plane:serve`
+- `npm run control-plane:smoke`
+- `npm run control-plane:test`
+- contribute to `npm run flowchain:full-smoke`
+
+Acceptance:
+- `npm test` passes for services.
+- `npm run control-plane:smoke` proves the full local lifecycle.
+- Browser workbench can consume the API without CORS failures.
+- API responses contain no private keys, mnemonics, RPC secrets, or seed
+  phrases.
+- `git diff --check` passes.
+- Open a PR and push your branch.

docs/agent-goals/full-l1/crypto-wallet.md

@@ -0,0 +1,63 @@
+/goal You are the FlowChain crypto, wallet, and local key agent.
+
+You are working in `E:\FlowMemory\flowmemory-crypto`.
+
+Mission: make FlowChain locally usable by adding the wallet/signing/object
+identity layer needed for a real private/local L1 testnet. Build on the existing
+`crypto/` package and `schemas/flowmemory/`. Do not create a second crypto
+package.
+
+Read first:
+- AGENTS.md
+- docs/FLOWCHAIN_FULL_PRIVATE_TESTNET.md
+- docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md
+- crypto/
+- schemas/flowmemory/
+- crates/flowmemory-devnet/ transaction/object model
+
+Allowed folders:
+- crypto/
+- schemas/flowmemory/
+- docs/DECISIONS/ for crypto/key decisions
+- docs/FLOWCHAIN_TESTNET_ACCEPTANCE.md only for acceptance evidence
+
+Do not edit:
+- apps/
+- services/ implementation
+- contracts/
+- hardware/
+- crates/flowmemory-devnet/ except tiny schema examples only if coordinated
+
+Build requirements:
+1. Define canonical local transaction envelopes with domain separation,
+   chain-id, nonce, signer, payload hash, and signature.
+2. Add object IDs, hash inputs, schemas, and vectors for:
+   AgentAccount, ModelPassport, WorkReceipt, ArtifactAvailabilityProof,
+   VerifierModule, VerifierReport, MemoryCell, Challenge, FinalityReceipt,
+   BridgeDeposit, BridgeCredit, BridgeWithdrawal, and local account balance.
+3. Add a local encrypted wallet/vault for test keys. It must support create,
+   unlock, list public accounts, sign transaction, import/export public metadata,
+   and rotate or create additional accounts.
+4. Keep secrets out of committed fixtures and exports.
+5. Add negative vectors for wrong chain id, wrong domain, wrong signer, replayed
+   nonce, malformed roots, malformed bridge deposit, and changed object type.
+6. Provide a small CLI or npm script surface that other agents can call for
+   wallet create/sign/verify.
+
+Expected commands to add or make work:
+- `npm run wallet:create --prefix crypto`
+- `npm run wallet:sign --prefix crypto`
+- `npm run wallet:verify --prefix crypto`
+- `npm run validate:vectors --prefix crypto`
+- contribute to `npm run flowchain:full-smoke`
+
+Acceptance:
+- `npm test --prefix crypto` passes.
+- crypto vector validation passes.
+- A local transaction envelope can be signed and verified without exposing the
+  private key.
+- The devnet agent can consume the envelope format.
+- The control-plane agent can display public signer/account metadata without
+  secrets.
+- `git diff --check` passes.
+- Open a PR and push your branch.