Publish pubsub messages over Iroh

docs/architecture.md

@@ -158,8 +158,12 @@ Automerge CRDT state. Automerge state encoding and sync are future work.
 `geth-pubsub` currently supports local publish/subscribe snapshots through the
 daemon control protocol. Messages live in a bounded in-memory ring buffer and
 are lost when the daemon stops. This is deliberate: pubsub is a lossy wakeup and
-presence channel, not authoritative storage. Iroh-gossip replication, private
-topics, and capability enforcement are future work.
+presence channel, not authoritative storage. `geth pubsub pub <topic> <message>
+--node <node-id>` can publish to an imported peer over the protected Iroh
+control ALPN. The remote daemon validates endpoint/card binding and requires
+`pubsub.publish` on `resource:pubsub:<topic>` before recording the message in
+its local ring buffer. Iroh-gossip replication and private topics are future
+work.
 
 `geth-pipe` currently supports `pipe listen/connect` against a local
 daemon-lifetime registry. This is a control-plane scaffold for names and

docs/roadmap.md

@@ -278,8 +278,12 @@ authorization and durable-state boundaries clear.
     buffer.
   - `[x]` Pubsub messages are documented and tested as lossy notifications, not
     durable facts.
-  - `[ ]` `geth pubsub pub/sub` works across local test nodes over Iroh.
-  - `[ ]` Pubsub publish/subscribe access is capability checked.
+  - `[x]` `geth pubsub pub <topic> <message> --node <node-id>` publishes to an
+    imported peer over Iroh.
+  - `[x]` Remote pubsub publish requires `pubsub.publish` on
+    `resource:pubsub:<topic>`.
+  - `[ ]` Replace bootstrap remote publish with iroh-gossip topics.
+  - `[ ]` Pubsub subscribe works across local test nodes over Iroh or gossip.
   - `[ ]` Docs and tests keep durable state in CAS/KV/document/db instead.
 
 ## Phase 4: Pipes, SSH Proxy, And SSH Distribution