Add prototype encrypted CAS blobs

AGENTS.md

@@ -134,7 +134,10 @@ Roadmap items should be actionable and checkable:
   can fetch CAS blobs from an imported signed peer card over Iroh when the peer
   grants `cas.fetch` on `resource:cas:local`; successful fetches record local
   provider metadata visible through `geth cas providers <hash>`. Full
-  `iroh-blobs` provider integration is still roadmap work.
+  `iroh-blobs` provider integration is still roadmap work. `geth cas
+  add-private/get-private` stores prototype encrypted CAS envelopes gated by
+  local resource secret epochs. The envelope is not audited AEAD and must not be
+  described as forward-secret or post-compromise-secure.
 - The CAS crate can build deterministic tree objects for local file trees and
   store those manifests as CAS blobs. The daemon can register and scan local
   file roots, reporting create/update/delete/rename changes without writing back