Subscribe to peer pubsub snapshots

docs/architecture.md

@@ -177,8 +177,10 @@ presence channel, not authoritative storage. `geth pubsub pub <topic> <message>
 --node <node-id>` can publish to an imported peer over the protected Iroh
 control ALPN. The remote daemon validates endpoint/card binding and requires
 `pubsub.publish` on `resource:pubsub:<topic>` before recording the message in
-its local ring buffer. Iroh-gossip replication and private topics are future
-work.
+its local ring buffer. `geth pubsub sub <topic> --node <node-id>` can read an
+authorized peer's current snapshot for that topic over the same protected path
+when the caller has `pubsub.subscribe` on `resource:pubsub:<topic>`. Iroh-gossip
+replication and private topics are future work.
 
 `geth-pipe` currently supports `pipe listen/connect` against a daemon-lifetime
 registry. `geth pipe connect <name> --node <node-id>` sends an authorized remote

docs/roadmap.md

@@ -294,8 +294,12 @@ authorization and durable-state boundaries clear.
     imported peer over Iroh.
   - `[x]` Remote pubsub publish requires `pubsub.publish` on
     `resource:pubsub:<topic>`.
+  - `[x]` `geth pubsub sub <topic> --node <node-id>` reads an authorized peer
+    snapshot over Iroh.
+  - `[x]` Remote pubsub subscribe requires `pubsub.subscribe` on
+    `resource:pubsub:<topic>`.
+  - `[x]` Tests cover denied and allowed remote pubsub subscribe.
   - `[ ]` Replace bootstrap remote publish with iroh-gossip topics.
-  - `[ ]` Pubsub subscribe works across local test nodes over Iroh or gossip.
   - `[ ]` Docs and tests keep durable state in CAS/KV/document/db instead.
 
 ## Phase 4: Pipes, SSH Proxy, And SSH Distribution