# ADR 0016: Owner-Rooted Node Enrollment

## Status

Accepted.

## Context

Geth needs a practical device-management flow: initialize a mesh with an
admin/owner identity, bind local daemon instances to named nodes/devices, list
devices by name, grant resource capabilities, and revoke devices. This must not
be a mutable device table because the project needs to evolve toward replicated
local-first authorization.

## Decision

Owner and node management is represented as signed keychain operations. `geth
init --admin-key <pub> --signing-key <key> --node-name <name>` records
`KeychainInit`, `AdminKeyAdd`, `UserAdd`, `DeviceAdd`, `NodeAdd`, and
`AgentBind` operations. When owner setup options are used, both `--admin-key`
and `--signing-key` are required. Geth signs canonical keychain payloads with
OpenSSH using the `geth.keychain.v1@geth.local` namespace.

The active device list is the reduced keychain view, surfaced through `geth node
list`. Renames and revocations are additional keychain operations. Resource
permissions remain resource-scoped auth operations and can be managed with
`geth node grant` and `geth node revoke-grant`.

`geth keychain sync <node>` pulls keychain operations and signatures over Iroh
from an imported peer. The receiver imports only operations with valid OpenSSH
signatures from currently trusted admin keys over the canonical keychain
payload. Discovery and peer cards still grant no trust by themselves.

## Consequences

Node names are convenience labels over stable node IDs. Endpoint rotation should
add or revoke endpoint bindings without replacing the node identity.

The current sync model is a pull-based signed operation log. It is not yet a
Keyhive-style convergent authority, does not implement advanced group
cryptography, and does not yet sign/verify replicated auth operations. Those are
future roadmap items.