diff --git a/AGENTS.md b/AGENTS.md
index 68afe12..3ee2254 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -105,6 +105,7 @@ Roadmap items should be actionable and checkable:
   daemon-owned Iroh endpoint startup, SSH certificate metadata, revocation
   metadata, user service definitions, and a pinned `geth-iroh` endpoint wrapper
   exist.
-- Peer auth over Iroh, cr-sqlite, iroh-docs, iroh-gossip, iroh-blobs, Automerge
-  sync, real auth enforcement, OpenSSH KRL generation, and Keyhive/BeeKEM-style
-  authorization are future roadmap items unless implemented later.
+- Relay policy, mDNS discovery, peer auth over Iroh, cr-sqlite, iroh-docs,
+  iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement, OpenSSH KRL
+  generation, and Keyhive/BeeKEM-style authorization are future roadmap items
+  unless implemented later.
diff --git a/docs/architecture.md b/docs/architecture.md
index 77b3df5..9b61979 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -26,6 +26,11 @@ a transitive `ed25519-dalek` prerelease dependency. `geth-iroh` wraps
 material, and shuts down through `Endpoint::close().await`. Relay mode defaults
 to disabled until daemon policy and discovery are implemented.
 
+The target product should use Iroh relay support for practical internet
+connectivity and mDNS/LAN discovery for local networks. These are connectivity
+and candidate-discovery mechanisms only. They do not grant trust, mutate
+authorization state, or make EndpointID knowledge sufficient for access.
+
 The daemon starts this endpoint during `geth daemon run` and keeps it alive for
 the daemon lifetime. When endpoint startup succeeds, the Iroh EndpointID is
 recorded as a transport binding for the stable geth node identity. If local UDP
diff --git a/docs/roadmap.md b/docs/roadmap.md
index a873f4b..ab823e9 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -74,6 +74,21 @@ geth-to-geth connections without granting trust from discovery alone.
   - Endpoint identity is bound to agent/node identity in local metadata.
   - Restarting the daemon preserves higher-level node identity.
 
+- `[ ]` Relay policy and configuration.
+  Acceptance criteria:
+  - Config can select disabled, default Iroh relays, staging relays, and future
+    custom relay maps.
+  - The intended product default uses relays unless explicitly disabled.
+  - `geth status --json` reports the selected relay mode.
+  - Tests cover config parsing and endpoint builder relay-mode selection.
+
+- `[ ]` LAN mDNS discovery.
+  Acceptance criteria:
+  - The daemon can advertise and discover local geth peer cards over mDNS.
+  - mDNS results are stored only as untrusted peer candidates.
+  - Discovered EndpointIDs do not grant module access without keychain/auth
+    validation.
+
 - `[ ]` Protocol/router scaffold.
   Acceptance criteria:
   - ALPN constants are registered through one module router.