Harden signed node authorization flow

docs/adr/0016-owner-node-enrollment.md

@@ -24,7 +24,11 @@ OpenSSH using the `geth.keychain.v1@geth.local` namespace.
 The active device list is the reduced keychain view, surfaced through `geth node
 list`. Renames and revocations are additional keychain operations. Resource
 permissions remain resource-scoped auth operations and can be managed with
-`geth node grant` and `geth node revoke-grant`.
+`geth node grant` and `geth node revoke-grant`; the CLI requires an admin
+`--signing-key` so these mutations replicate as signed auth operations.
+Endpoint rotation is modeled with signed `NodeEndpointAdd` and
+`NodeEndpointRevoke` operations exposed as `geth node endpoint-add` and
+`geth node endpoint-revoke`.
 
 New nodes can request enrollment with `geth node enroll request`. The request is
 signed by the requesting agent key and includes the stable node ID, agent ID,
@@ -52,6 +56,5 @@ add or revoke endpoint bindings without replacing the node identity.
 
 The current sync model is a pull-based signed operation log. It is not yet a
 Keyhive-style convergent authority and does not implement advanced group
-cryptography. Manual grant/revoke commands still need the same signing
-requirement as enrollment approval before this becomes a complete authorization
-workflow.
+cryptography. Conflict resolution for concurrent signed operations is still the
+deterministic reducer, not a richer collaborative authority protocol.

docs/architecture.md

@@ -282,11 +282,13 @@ and signs them with OpenSSH under `geth.keychain.v1@geth.local`. Both keys are
 required when owner setup options are used, so the node does not create unsigned
 owner statements by accident. `geth node list` shows the active reduced node
 view. `geth node rename` and `geth node revoke` record signed keychain
-operations and require `--signing-key`. `geth keychain sync <node>` pulls
-keychain operations and signatures from an imported peer over Iroh and imports
-only operations with a valid OpenSSH signature from a currently trusted admin key
-over the canonical payload. This is currently a pull-based signed operation log,
-not a CRDT or Keyhive-style convergent authority.
+operations and require `--signing-key`. Endpoint rotation is explicit:
+`geth node endpoint-add` and `geth node endpoint-revoke` record signed
+`NodeEndpointAdd` and `NodeEndpointRevoke` keychain operations. `geth keychain
+sync <node>` pulls keychain operations and signatures from an imported peer over
+Iroh and imports only operations with a valid OpenSSH signature from a currently
+trusted admin key over the canonical payload. This is currently a pull-based
+signed operation log, not a CRDT or Keyhive-style convergent authority.
 
 New devices can use the node enrollment flow instead of hand-editing keychain
 state. `geth node enroll request` creates a canonical, agent-key-signed request
@@ -303,9 +305,11 @@ grants, revocations, groups, and `auth explain`. Auth operations reduce into a
 current permission view for resources, grants, groups, and bearer access. The
 library can explain direct and group grants. The daemon persists local auth
 grant/revoke operations and `geth auth explain` evaluates that local operation
-log. Enrollment approval and auth sync attach and verify OpenSSH admin
-signatures for replicated auth operations. Broader delegated authority and
-module enforcement are still future work.
+log. `geth node grant`, `geth node revoke-grant`, `geth auth grant`, and `geth
+auth revoke` require `--signing-key` in the CLI and store OpenSSH-signed auth
+operations. Enrollment approval uses the same signed auth operation path. Auth
+sync imports only auth operations signed by currently trusted admin keys.
+Broader delegated authority and module enforcement are still future work.
 
 Capability evaluation supports exact matches plus explicit scoped forms. For KV,
 `kv.write_prefix:<prefix>` grants writes requested as `kv.write_key:<key>` only

docs/roadmap.md

@@ -196,6 +196,8 @@ resource-scoped capability decisions.
     for device/node/agent/endpoint enrollment.
   - `[x]` `geth node enroll sync <owner-node>` pulls approved signed keychain
     and auth state onto the requesting node.
+  - `[x]` `geth node endpoint-add/revoke --signing-key` records signed endpoint
+    rotation operations.
 
 - `[x]` Keychain operation reducer.
   Acceptance criteria:
@@ -204,19 +206,18 @@ resource-scoped capability decisions.
   - Revoked keys/devices/nodes are excluded from active views.
   - Tests cover add, rename, revoke, and endpoint rotation.
 
-- `[~]` Node capability management.
+- `[x]` Node capability management.
   Acceptance criteria:
   - `[x]` `geth node grant <node> <resource> <capability>` records a
-    resource-scoped capability grant for a known node.
+    signed resource-scoped capability grant for a known node.
   - `[x]` `geth node revoke-grant <resource> <grant-id>` records grant
-    revocation.
+    revocation as a signed auth op.
   - `[x]` Node names can be used for management commands where the keychain view
     has a unique active node name.
   - `[x]` Enrollment approval signs capability grants as auth ops.
   - `[x]` `geth auth sync <node>` imports only auth ops signed by currently
     trusted admin keys.
-  - `[ ]` Future completion requires signed auth ops for every manual
-    grant/revoke command, not only enrollment approval and replicated imports.
+  - `[x]` `geth auth grant/revoke --signing-key` records signed auth ops.
 
 - `[x]` Resource auth operation reducer.
   Acceptance criteria:
@@ -228,13 +229,13 @@ resource-scoped capability decisions.
 
 - `[~]` `auth explain` real decision path.
   Acceptance criteria:
-  - `[x]` `geth auth grant` and `geth auth revoke` persist local auth ops.
+  - `[x]` `geth auth grant` and `geth auth revoke` persist signed local auth
+    ops when run through the CLI.
   - `[x]` `geth auth explain <subject> <resource> <capability>` reports
     allowed/denied from the local auth-op reducer when local ops exist.
   - `[x]` Output includes the grant ID or missing grant that caused the result.
   - `[x]` JSON output is stable enough for tests and scripts.
-  - `[ ]` Future completion requires signed-op validation before accepting
-    replicated auth ops.
+  - `[x]` Replicated auth sync requires trusted-admin signatures before import.
 
 - `[~]` Resource secrets and bearer invites.
   Acceptance criteria: