Connect pipes over Iroh control

README.md

@@ -120,7 +120,8 @@ The bootstrap implementation provides:
   - `geth ssh revocation export --out <path> [--format jsonl|openssh-krl-spec|openssh-krl]`
   - `geth ssh revocation import <path> [--format jsonl|openssh-krl-spec]`
   - `geth ssh revocation sync <node-id>`
-- local pipe registry commands: `geth pipe listen/connect`
+- pipe registry/connect commands: `geth pipe listen <name>` and
+  `geth pipe connect <name> [--node <node-id>]`
 
 `geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
 include the Iroh EndpointID plus currently known relay/direct addresses.
@@ -151,6 +152,10 @@ Remote pubsub publish uses the protected Iroh control path too. The remote peer
 requires `pubsub.publish` on `resource:pubsub:<topic>` before recording the
 message in its local daemon-lifetime ring buffer. Pubsub remains lossy and is
 not durable storage.
+Remote pipe connect uses the same protected Iroh control path and requires
+`pipe.connect` on `resource:pipe:<name>`. The current prototype records a remote
+connection attempt and whether a listener exists; byte streaming and forwarding
+are still future work.
 Importing or pinging a peer card never grants capabilities by itself.
 When `[iroh].local_discovery = true`, the daemon also advertises and discovers
 signed peer cards on LAN using a geth-specific mDNS TXT payload. That payload is