Track CAS providers

README.md

@@ -93,7 +93,7 @@ The bootstrap implementation provides:
 - `geth auth grant <subject> <resource> <capability> [--grant-id <id>]`
 - `geth auth revoke <resource> <grant-id>`
 - local filesystem CAS commands: `add`, `get`, `fetch`, `hash`, `has`, `pin`,
-  `unpin`, `cleanup`, `list`
+  `unpin`, `cleanup`, `providers`, `list`
 - local CAS tree objects describe file trees and are stored as CAS blobs
 - local file-root commands: `geth cas root add/list/scan`
 - local file conflict metadata commands:
@@ -136,9 +136,10 @@ card binds the actual Iroh EndpointID before reducing resource-local auth ops.
 `geth cas fetch <node-id> <hash>` uses the same protected Iroh control path to
 request a blob from a peer. The remote daemon only returns bytes when the caller
 has `cas.fetch` on `resource:cas:local`, and the caller verifies that the bytes
-hash to the requested BLAKE3 CAS hash before storing them locally. This is the
-bootstrap transfer path; future work will move provider/fetch behavior to
-`iroh-blobs`.
+hash to the requested BLAKE3 CAS hash before storing them locally. Successful
+fetches record the serving peer as a local provider, visible with
+`geth cas providers <hash>`. This is the bootstrap transfer path; future work
+will move provider/fetch behavior to `iroh-blobs`.
 `geth ssh cert sync <node-id>` requires `ssh_cert.sync` on `resource:ssh:certs`
 at the peer. `geth ssh revocation sync <node-id>` requires
 `ssh_revocation.sync` on `resource:ssh:revocations`. Both commands merge