Wire KV sync through iroh-docs

docs/adr/0011-kv-iroh-documents.md

@@ -12,8 +12,13 @@ prefix-scoped capabilities.
 
 ## Consequences
 
-The prototype exposes CLI shape and durable local KV state. `iroh-docs 0.95.0`
-is pinned and compiles against the daemon-owned `iroh 0.95.1` endpoint
-generation, so the remaining work is replacing the bootstrap control-path KV
-sync with an Iroh Documents namespace implementation and resource-scoped
-authorization checks around namespace access.
+The prototype keeps SQLite as the durable local KV index and mirrors each named
+KV store into an Iroh Documents namespace on the daemon-owned `iroh 0.95.1`
+endpoint. Remote `geth kv sync` still uses geth control as the authorization
+preflight. If the caller has `kv.read` on the remote `resource:kv:<name>`, the
+remote daemon returns a read-only Iroh Documents ticket and the requester imports
+entries through `iroh-docs 0.95.0`.
+
+The daemon must not hand out Iroh Documents write capabilities as a substitute
+for geth authorization. Write authority remains modeled through geth resource
+capabilities such as `kv.write` and `kv.write_prefix:<prefix>`.

docs/architecture.md

@@ -35,17 +35,19 @@ exposes their native ALPNs without creating a second daemon endpoint. CAS now
 registers an `iroh-blobs` provider handler on `/iroh-bytes/4`; local CAS writes
 are mirrored into the native blob store, and remote `geth cas fetch` performs a
 geth control-ALPN authorization preflight before transferring payload bytes over
-`iroh-blobs`. `geth status` reports these native backend libraries. KV and
-pubsub still use explicit documented bootstrap equivalents until each module is
-migrated to its native protocol.
+`iroh-blobs`. KV now starts `iroh-docs` with `iroh-gossip` and the same native
+blob store, mirrors named KV stores into read-shared Iroh Documents namespaces,
+and sends read-only docs tickets only after geth control authorization succeeds.
+`geth status` reports CAS and KV as wired native backends. Pubsub still uses its
+explicit documented bootstrap equivalent until it is migrated to native gossip.
 
 Module ALPNs are registered through `geth-iroh`'s protocol router scaffold. The
 router owns the default protocol descriptors, rejects duplicate ALPN
 registrations, and returns explicit unknown-ALPN errors. The current daemon
 accept loop dispatches geth control, pipe, SSH-proxy, and native CAS blob
-streams directly; the next backend migrations should attach iroh-docs and
-iroh-gossip handlers to the same endpoint instead of creating parallel
-endpoints.
+streams directly, plus native docs and gossip streams used by KV. The next
+backend migration should attach application pubsub behavior to iroh-gossip
+instead of creating parallel endpoints.
 
 The target product should use Iroh relay support for practical internet
 connectivity and mDNS/LAN discovery for local networks. These are connectivity
@@ -203,18 +205,17 @@ or cr-sqlite extension artifact. DB sync intentionally does not use CAS-backed
 snapshots or batch blobs in the prototype. Those become useful when initial
 catch-up or large batches outgrow the protected control path.
 
-`geth-kv` currently provides a SQLite-backed local fallback for named KV stores
-through `kv create/set/get`. `kv set --subject <principal>` evaluates local auth
-ops for `kv.write_key:<key>` so prefix grants can be tested before networked
-callers exist. The local node/agent retains owner access for administration.
-Iroh Documents namespaces remain the target backend, but the bootstrap can sync
-named KV stores over the protected Iroh control ALPN. `geth kv sync <node-id>
-<name>` requires `kv.read` on the remote `resource:kv:<name>`, transfers entries
-at or beyond a per-peer/per-KV high-water cursor, and imports only values that
-are at least as new as the local entry timestamp. The daemon background
-live-sync loop runs the same KV sync for local KV stores and known peers.
-Private value encryption should use resource secret epochs before payloads are
-exposed to remote peers.
+`geth-kv` keeps SQLite as the durable local index for named KV stores through
+`kv create/set/get`. `kv set --subject <principal>` evaluates local auth ops for
+`kv.write_key:<key>` so prefix grants can be tested. The daemon mirrors local KV
+entries and metadata into an Iroh Documents namespace per named store. `geth kv
+sync <node-id> <name>` still starts with a protected geth control request that
+requires `kv.read` on the remote `resource:kv:<name>`; if authorized, the remote
+daemon returns a read-only docs ticket and the requester imports entries through
+Iroh Documents. The control response still carries bootstrap entries for
+compatibility. The daemon background live-sync loop runs the same KV sync for
+local KV stores and known peers. Private value encryption should use resource
+secret epochs before payloads are exposed to remote peers.
 
 `geth-document` registers local document resources and stores durable Automerge
 save bytes in the local SQLite metadata store. The CLI still accepts and returns

docs/roadmap.md

@@ -486,7 +486,7 @@ authorization and durable-state boundaries clear.
     rejection.
   - `[x]` Docs explicitly avoid claiming forward secrecy or PCS.
 
-- `[~]` Iroh-docs KV integration.
+- `[x]` Iroh-docs KV integration.
   Acceptance criteria:
   - `[x]` `geth kv create/set/get` works against a named local KV resource.
   - `[x]` KV metadata and entries are durable in the local SQLite store.
@@ -500,7 +500,10 @@ authorization and durable-state boundaries clear.
   - `[x]` Remote KV sync requires `kv.read` on `resource:kv:<name>`.
   - `[x]` Background live-sync refreshes local KV stores from known peers using
     per-peer/per-KV high-water cursors.
-  - `[ ]` KV metadata is replicated through Iroh Documents.
+  - `[x]` KV metadata is replicated through Iroh Documents.
+  - `[x]` Authorized peers receive read-only Iroh Documents tickets, not write
+    capabilities, after geth control authorization succeeds.
+  - `[x]` Tests cover imported KV docs state after authorized remote sync.
 
 - `[~]` Iroh-gossip pubsub integration.
   Acceptance criteria: