[codex] Extend local FlowChain control-plane API

[FlowmemoryAI]

Summary

Extends the existing services/control-plane API in place for the FlowChain private/local testnet control plane. The loader now prefers ignored live devnet/local/ state and handoff files, then falls back to committed deterministic fixtures.

Adds JSON-RPC and browser-safe HTTP helper coverage for node status, peers, mempool, accounts, balances, faucet status, wallet public metadata, AgentAccount, ModelPassport, WorkReceipt, ArtifactAvailabilityProof, VerifierModule, VerifierReport, MemoryCell, Challenge, FinalityReceipt, bridge observations/deposits/credits, withdrawals, provenance, and raw JSON.

Adds local write intake for transaction_submit / POST /transactions, forwarding test transactions to the existing Rust devnet submit-fixture path, plus bridge observation intake through bridge_observation_submit / POST /bridge/observations.

Scope

Allowed folders used:

• services/control-plane/
• docs/FLOWCHAIN_CONTROL_PLANE_API.md
• docs/INDEXER_VERIFIER_MVP.md
• package.json

Forbidden folders were not edited.

Worktree: E:\FlowMemory\flowmemory-indexer

Validation

• npm test passed
• npm run control-plane:smoke passed with 57 JSON-RPC calls and noSecretResponseScan: passed
• git diff --check passed

Attempted:

• npm run flowchain:full-smoke stops at the existing prerequisite gate because apps/dashboard/node_modules and crypto/node_modules are not installed locally. I did not install those because they are outside this task's allowed edit scope.

Risks and Follow-ups

• The runtime remains the bounded deterministic Rust CLI, not a long-running node; node_status reports longRunningNode: false.
• Bridge credit and withdrawal surfaces are local observation/projection APIs only and do not imply production bridge custody, release signing, or production finality.
• transaction_submit queues transactions; block production remains in the existing devnet run paths.

HQ Required Review Metadata (2026-05-14)

Issue status: Original #101 lane is closed on GitHub; needs new/open issue if work remains
Worktree / branch ownership: E:\FlowMemory\flowmemory-indexer
Allowed folders: services/control-plane/, docs/FLOWCHAIN_CONTROL_PLANE_API.md, docs/INDEXER_VERIFIER_MVP.md, package.json
Forbidden folders: crates/, crypto/, contracts/, apps/dashboard/, hardware/, unrelated services/
Exact checks recorded:

• npm test; npm run control-plane:smoke with 57 JSON-RPC calls and noSecretResponseScan passed; git diff --check; attempted npm run flowchain:full-smoke but local dashboard/crypto dependencies were missing; GitHub CI checks listed below.
• GitHub CI Repository hygiene: SUCCESS
• GitHub CI Contracts: SUCCESS
• GitHub CI Services and launch core: SUCCESS
• GitHub CI Launch-core acceptance command: SUCCESS
• GitHub CI Crypto: SUCCESS
• GitHub CI Dashboard: SUCCESS
• GitHub CI Local devnet: SUCCESS
• GitHub CI Hardware POC: SUCCESS
  HQ readiness: Draft; merge state DIRTY; close as superseded or refresh against current main and a new/open issue.

[FlowmemoryAI]

HQ review note, 2026-05-13: this draft matches the #101 control-plane lane and its CI is passing. Please link issue #101 in the PR body before merge. Merge order: after #111 lands; it should precede #112 if the workbench depends on these expanded methods, and coordinate with #113 for bridge observation/credit intake. Main review focus: no-secret response scan coverage, transaction_submit/bridge_observation_submit contracts, package command compatibility with #111/#113, and no hosted/production API claim.

[FlowmemoryAI]

HQ review blocker, 2026-05-14: before merge readiness review, please add a dedicated Checks run section with exact local commands and results, including git diff --check, and link #101 in the PR body. The current note about flowchain:full-smoke stopping at missing local dependencies is useful, but it needs to sit alongside the successful local checks and exact blocker evidence.

[FlowmemoryAI]

HQ reconciliation note, 2026-05-14: GitHub now shows linked control-plane issue #101 as closed. Before merge review, please either close this draft if it was superseded by merged main, or refresh the PR body with the exact remaining delta and a new/open issue reference for anything still needed.