Connect pipes over Iroh control

docs/architecture.md

@@ -165,10 +165,13 @@ control ALPN. The remote daemon validates endpoint/card binding and requires
 its local ring buffer. Iroh-gossip replication and private topics are future
 work.
 
-`geth-pipe` currently supports `pipe listen/connect` against a local
-daemon-lifetime registry. This is a control-plane scaffold for names and
-connection attempts only; it does not carry bytes, forward sockets, or use Iroh
-streams yet.
+`geth-pipe` currently supports `pipe listen/connect` against a daemon-lifetime
+registry. `geth pipe connect <name> --node <node-id>` sends an authorized remote
+connect request over the protected Iroh control ALPN. The remote daemon validates
+endpoint/card binding and requires `pipe.connect` on `resource:pipe:<name>`
+before recording the connection attempt and reporting whether a listener exists.
+This is still a control-plane scaffold for names and connection attempts only;
+it does not carry bytes or forward sockets yet.
 
 `geth-ssh-proxy` currently defines types, command shape, and roadmap stubs.
 

docs/roadmap.md

@@ -296,8 +296,13 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     registry.
   - `[x]` Tests cover local listener registration, local connect matching, and
     daemon restart behavior.
-  - `[ ]` `geth pipe listen/connect` can connect two local test nodes over Iroh.
-  - `[ ]` Pipe access requires `pipe.listen` or `pipe.connect`.
+  - `[x]` `geth pipe connect <name> --node <node-id>` can connect to an
+    imported peer over Iroh at the control-plane level.
+  - `[x]` Remote pipe connect requires `pipe.connect` on
+    `resource:pipe:<name>`.
+  - `[ ]` Remote pipe listen requires `pipe.listen` when remote listener
+    creation is added.
+  - `[ ]` Pipe connect carries bidirectional byte streams over Iroh.
   - `[ ]` Streams close cleanly and propagate errors.
 
 - `[ ]` TCP forwarding.