Store documents as Automerge state

docs/architecture.md

@@ -209,15 +209,16 @@ live-sync loop runs the same KV sync for local KV stores and known peers.
 Private value encryption should use resource secret epochs before payloads are
 exposed to remote peers.
 
-`geth-document` currently registers local document resources and stores
-validated JSON state in the local SQLite metadata store through
-`document create/status/set/get`. This is a bootstrap editing surface, not yet
-Automerge CRDT state. `geth document sync <node-id> <name>` can pull remote JSON
-state over the protected Iroh control ALPN when the peer grants `document.read`
-on `resource:document:<name>`. The daemon background live-sync loop runs the same
-sync for local documents and known peers using per-peer/per-document cursors.
-The import rule is last-writer-wins by document timestamp. Automerge state
-encoding and sync are future work.
+`geth-document` registers local document resources and stores durable Automerge
+save bytes in the local SQLite metadata store. The CLI still accepts and returns
+validated JSON views for `document create/status/set/get`, but the persisted
+state is an Automerge envelope containing binary save data plus the current JSON
+view for operator output. `geth document sync <node-id> <name>` pulls remote
+Automerge state over the protected Iroh control ALPN when the peer grants
+`document.read` on `resource:document:<name>`. The daemon background live-sync
+loop runs the same sync for local documents and known peers using
+per-peer/per-document cursors. Received Automerge documents are merged before
+being stored.
 
 `geth-pubsub` currently supports local publish/subscribe snapshots through the
 daemon control protocol. Messages live in a bounded in-memory ring buffer and

docs/roadmap.md

@@ -47,11 +47,11 @@ Implementation order:
    - `[x]` Keep ambiguous changes as durable conflicts.
    - `[x]` Add two-root integration coverage.
 
-4. `[ ]` Replace JSON document state with durable Automerge documents.
+4. `[x]` Replace JSON document state with durable Automerge documents.
    Acceptance criteria:
-   - `[ ]` Store Automerge documents durably.
-   - `[ ]` Sync Automerge changes over Iroh.
-   - `[ ]` Gate document sync with resource authorization.
+   - `[x]` Store Automerge documents durably.
+   - `[x]` Sync Automerge changes over Iroh.
+   - `[x]` Gate document sync with resource authorization.
 
 5. `[ ]` Harden DB sync for real cr-sqlite usage.
    Acceptance criteria:
@@ -115,12 +115,13 @@ Implementation order:
   - `[x]` Tests cover create/update/delete/rename application across two local
     roots.
 
-- `[~]` Durable Automerge documents.
+- `[x]` Durable Automerge documents.
   Acceptance criteria:
-  - `[ ]` Document state is stored as durable Automerge data, not only JSON
+  - `[x]` Document state is stored as durable Automerge data, not only JSON
     last-writer-wins state.
-  - `[ ]` Sync converges according to Automerge semantics across two nodes.
-  - `[ ]` Resource authorization gates remote document reads and writes.
+  - `[x]` Sync exchanges durable Automerge state over the protected Iroh
+    control path and merges received Automerge documents.
+  - `[x]` Resource authorization gates remote document reads and writes.
 
 - `[~]` Operational first-run polish.
   Acceptance criteria:
@@ -665,24 +666,24 @@ Automerge documents.
 - `[~]` Automerge document resource.
   Acceptance criteria:
   - `[x]` `geth document create/status` works for local documents.
-  - `[x]` Document metadata and empty JSON state are stored durably.
-  - `[x]` `geth document set/get` stores and returns validated local JSON
-    state.
-  - `[x]` Tests cover create, update, save, and reload of local JSON document
-    state.
-  - `[x]` `geth document sync <node-id> <name>` pulls authorized JSON state
+  - `[x]` Document metadata and empty Automerge state are stored durably.
+  - `[x]` `geth document set/get` stores durable Automerge save bytes and
+    returns a validated JSON view.
+  - `[x]` Tests cover create, update, save, and reload of local Automerge
+    document state.
+  - `[x]` `geth document sync <node-id> <name>` pulls authorized Automerge state
     from an imported peer over Iroh.
-  - `[x]` Background live-sync refreshes local JSON documents from known peers
+  - `[x]` Background live-sync refreshes local Automerge documents from known peers
     using per-peer/per-document cursors.
-  - `[ ]` Automerge document state is stored durably.
-  - `[ ]` Tests cover Automerge create, update, save, and reload.
+  - `[x]` Automerge document state is stored durably.
+  - `[x]` Tests cover Automerge create, update, save, and reload.
 
-- `[ ]` Automerge sync over Iroh.
+- `[x]` Automerge sync over Iroh.
   Acceptance criteria:
-  - `[x]` Bootstrap JSON last-writer-wins sync works across two local test
-    nodes over Iroh.
-  - Resource authorization gates read/write sync.
-  - Conflicts converge according to Automerge semantics.
+  - `[x]` Automerge state sync works across two local test nodes over Iroh.
+  - `[x]` Resource authorization gates read/write sync.
+  - `[x]` Received Automerge documents are merged rather than stored as raw
+    JSON blobs.
 
 ## Phase 6: File Sync And Advanced Local-First Auth