Add daemon-owned Iroh endpoint

docs/architecture.md

@@ -18,6 +18,20 @@ Remote geth node-to-node communication is Iroh-only. The daemon will own one
 shared Iroh endpoint and register module protocols on ALPNs such as
 `/geth/cas/1`, `/geth/kv/1`, `/geth/pipe/1`, and `/geth/ssh-proxy/1`.
 
+The first pinned Iroh integration uses `iroh = 0.90.0`, because newer
+Rust-1.85-compatible candidates in the 0.93-0.95 range failed to compile through
+a transitive `ed25519-dalek` prerelease dependency. `geth-iroh` wraps
+`iroh::Endpoint::builder()`, configures geth ALPNs with `Builder::alpns`, uses
+`Builder::relay_mode`, persists an `iroh::SecretKey` as hex-encoded 32-byte key
+material, and shuts down through `Endpoint::close().await`. Relay mode defaults
+to disabled until daemon policy and discovery are implemented.
+
+The daemon starts this endpoint during `geth daemon run` and keeps it alive for
+the daemon lifetime. When endpoint startup succeeds, the Iroh EndpointID is
+recorded as a transport binding for the stable geth node identity. If local UDP
+binding is unavailable, the daemon keeps local control running and reports the
+Iroh startup error through status output.
+
 SSH keys are not transport keys. They are admin trust anchors and signing
 identities for keychain and authorization operations. SSH proxying, when added,
 will carry SSH bytes over an authorized Iroh stream and will not make SSH a geth

docs/roadmap.md

@@ -60,14 +60,14 @@ control, local CAS, service installation, and written architecture decisions.
 Goal: make the daemon own a real Iroh endpoint and establish authenticated
 geth-to-geth connections without granting trust from discovery alone.
 
-- `[ ]` Pin and compile Iroh dependencies.
+- `[x]` Pin and compile Iroh dependencies.
   Acceptance criteria:
   - `iroh` is added only after APIs are pinned and `cargo check --workspace`
     passes.
   - `geth-iroh` exposes endpoint startup/shutdown wrappers.
   - Docs note exact crate versions and any API assumptions.
 
-- `[ ]` Daemon-owned Iroh endpoint.
+- `[x]` Daemon-owned Iroh endpoint.
   Acceptance criteria:
   - The daemon creates one shared Iroh endpoint on startup.
   - `geth status --json` reports endpoint status and EndpointID.