Fetch CAS blobs over Iroh

docs/roadmap.md

@@ -218,11 +218,19 @@ resource-scoped capability decisions.
 Goal: turn local CAS and stubs into Iroh-backed replicated modules while keeping
 authorization and durable-state boundaries clear.
 
-- `[ ]` Iroh-blobs CAS integration.
+- `[~]` Iroh-blobs CAS integration.
   Acceptance criteria:
-  - Local CAS can provide and fetch blobs over Iroh.
-  - Provider tracking is recorded locally.
-  - Local add/get/hash/has/list behavior remains backward compatible.
+  - `[x]` `geth cas fetch <node-id> <hash>` can fetch a blob from an imported
+    peer over the daemon-owned Iroh control ALPN.
+  - `[x]` The serving peer validates the caller's signed peer card against the
+    observed Iroh EndpointID before considering authorization.
+  - `[x]` Remote CAS fetch requires `cas.fetch` on `resource:cas:local`.
+  - `[x]` The requester verifies returned bytes against the requested BLAKE3
+    CAS hash before storing them locally.
+  - `[x]` Local add/get/hash/has/list behavior remains backward compatible.
+  - `[ ]` Replace the bootstrap control-ALPN transfer with `iroh-blobs`
+    provider/fetch behavior.
+  - `[ ]` Provider tracking is recorded locally.
 
 - `[x]` CAS pin and cache policy.
   Acceptance criteria: