Add local KV store commands

docs/architecture.md

@@ -97,8 +97,12 @@ and file sync trees are future work.
 local-only sync status plus placeholder schema metadata. cr-sqlite loading,
 change extraction, and DB sync are future work.
 
-`geth-kv`, `geth-document`, `geth-pubsub`, `geth-pipe`, and `geth-ssh-proxy`
-currently define types, command shape, and roadmap stubs.
+`geth-kv` currently provides a SQLite-backed local fallback for named KV stores
+through `kv create/set/get`. Iroh Documents namespaces, prefix authorization
+enforcement, and replication are future work.
+
+`geth-document`, `geth-pubsub`, `geth-pipe`, and `geth-ssh-proxy` currently
+define types, command shape, and roadmap stubs.
 
 `geth-ssh-identity` defines SSH trust namespaces plus certificate request,
 approval, certificate import, and revocation-list data models. The bootstrap

docs/roadmap.md

@@ -215,11 +215,12 @@ authorization and durable-state boundaries clear.
   - Access is gated by resource secret epoch material.
   - Docs explicitly avoid claiming forward secrecy or PCS.
 
-- `[ ]` Iroh-docs KV integration.
+- `[~]` Iroh-docs KV integration.
   Acceptance criteria:
-  - `geth kv create/set/get` works against a named KV resource.
-  - Prefix-scoped capabilities can allow or deny writes.
-  - KV metadata is durable and replicated through Iroh Documents.
+  - `[x]` `geth kv create/set/get` works against a named local KV resource.
+  - `[x]` KV metadata and entries are durable in the local SQLite store.
+  - `[ ]` Prefix-scoped capabilities can allow or deny writes.
+  - `[ ]` KV metadata is replicated through Iroh Documents.
 
 - `[ ]` Iroh-gossip pubsub integration.
   Acceptance criteria: