Add KV prefix capability matching

docs/architecture.md

@@ -138,6 +138,11 @@ grant/revoke operations and `geth auth explain` evaluates that local operation
 log. Signature validation, replication, and module enforcement are still future
 work.
 
+Capability evaluation supports exact matches plus explicit scoped forms. For KV,
+`kv.write_prefix:<prefix>` grants writes requested as `kv.write_key:<key>` only
+when the key is under that prefix; `kv.write` remains the broad write
+capability. Command-level KV enforcement is still future work.
+
 Both keychain and auth operations use `geth-codec` canonical envelopes for
 signature payloads. The envelope includes a version, an explicit signature
 namespace, and the operation payload encoded with postcard. JSON remains useful

docs/roadmap.md

@@ -225,7 +225,10 @@ authorization and durable-state boundaries clear.
   Acceptance criteria:
   - `[x]` `geth kv create/set/get` works against a named local KV resource.
   - `[x]` KV metadata and entries are durable in the local SQLite store.
-  - `[ ]` Prefix-scoped capabilities can allow or deny writes.
+  - `[x]` The auth evaluator allows `kv.write_prefix:<prefix>` grants to
+    satisfy matching `kv.write_key:<key>` requests.
+  - `[x]` Tests cover allowed and denied prefix-scoped KV write explanations.
+  - `[ ]` `geth kv set` enforces local capability decisions for the caller.
   - `[ ]` KV metadata is replicated through Iroh Documents.
 
 - `[~]` Iroh-gossip pubsub integration.