Sync SSH metadata over Iroh

AGENTS.md

@@ -107,7 +107,8 @@ Roadmap items should be actionable and checkable:
   pinned `geth-iroh` endpoint wrapper with protocol-router scaffold, peer-card
   types, manual signed peer-card export/import/list commands, `geth peer ping`
   and `geth peer auth-check` over Iroh, signed peer-card LAN discovery payloads,
-  authorized `geth cas fetch` over the Iroh control ALPN, untrusted
+  authorized `geth cas fetch`, `geth ssh cert sync`, and
+  `geth ssh revocation sync` over the Iroh control ALPN, untrusted
   discovery-backend trait, custom relay-map config, and Iroh local-network
   discovery toggle exist.
 - Canonical signed-operation envelopes exist for keychain/auth signature
@@ -157,7 +158,10 @@ Roadmap items should be actionable and checkable:
   specification imports are supported; binary KRL import is unsupported because
   OpenSSH KRL files are not enumerable through OpenSSH tooling. Tests cover
   public-key and certificate binary KRL revocations when `ssh-keygen` is
-  available.
+  available. Authorized peers can pull SSH certificate-flow metadata with
+  `ssh_cert.sync` on `resource:ssh:certs` and revocation metadata with
+  `ssh_revocation.sync` on `resource:ssh:revocations`; this is pull-only
+  metadata sync, not yet a CRDT/resource-log replication model.
 - cr-sqlite, iroh-docs, iroh-blobs provider/fetch, Automerge sync, broader auth
   enforcement, and Keyhive/BeeKEM-style authorization are future roadmap items
   unless implemented later.