Wire keychain status to local keychain ops

docs/architecture.md

@@ -105,7 +105,10 @@ The identity plane is `geth-keychain`: admin keys, users, devices, nodes, agents
 and endpoint bindings. Endpoint rotation must not destroy higher-level node
 identity. Keychain operations reduce into an active view containing current
 admin keys, users, devices, node records, agent bindings, and endpoint-to-node
-bindings. Revoked identity subtrees are excluded from that active view.
+bindings. Revoked identity subtrees are excluded from that active view. The
+daemon persists local keychain init/admin-key operations and `keychain status`
+reports the reduced local view. OpenSSH signature capture and verification for
+those operations is still future work.
 
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`. Auth operations reduce into a

docs/roadmap.md

@@ -138,11 +138,16 @@ resource-scoped capability decisions.
   - JSON is not used as the signed representation.
   - Tests verify equivalent operations hash/sign identically across runs.
 
-- `[ ]` SSH-admin-rooted keychain initialization.
+- `[~]` SSH-admin-rooted keychain initialization.
   Acceptance criteria:
-  - `geth keychain init` records a signed `KeychainInit`.
-  - OpenSSH signature namespaces are explicit.
-  - Missing `ssh-keygen` or unavailable hardware keys produce clear errors.
+  - `[x]` `geth keychain init` records a local `KeychainInit`.
+  - `[x]` `geth keychain init --admin-key <path>` records an admin SSH public
+    key fingerprint.
+  - `[x]` `geth keychain status` reports the reduced local keychain view.
+  - `[ ]` Future completion records signed `KeychainInit` operations.
+  - `[ ]` OpenSSH signature namespaces are explicit in the signing flow.
+  - `[ ]` Missing `ssh-keygen` or unavailable hardware keys produce clear
+    errors during signing.
 
 - `[x]` Keychain operation reducer.
   Acceptance criteria: