Implement keychain view reducer

docs/architecture.md

@@ -103,7 +103,9 @@ generate OpenSSH KRL binaries or replicate the lists over Iroh.
 
 The identity plane is `geth-keychain`: admin keys, users, devices, nodes, agents,
 and endpoint bindings. Endpoint rotation must not destroy higher-level node
-identity.
+identity. Keychain operations reduce into an active view containing current
+admin keys, users, devices, node records, agent bindings, and endpoint-to-node
+bindings. Revoked identity subtrees are excluded from that active view.
 
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`.

docs/roadmap.md

@@ -144,7 +144,7 @@ resource-scoped capability decisions.
   - OpenSSH signature namespaces are explicit.
   - Missing `ssh-keygen` or unavailable hardware keys produce clear errors.
 
-- `[ ]` Keychain operation reducer.
+- `[x]` Keychain operation reducer.
   Acceptance criteria:
   - Admin keys, users, devices, nodes, agents, and endpoint bindings reduce into
     a current keychain view.