Harden signed node authorization flow

docs/roadmap.md

@@ -196,6 +196,8 @@ resource-scoped capability decisions.
     for device/node/agent/endpoint enrollment.
   - `[x]` `geth node enroll sync <owner-node>` pulls approved signed keychain
     and auth state onto the requesting node.
+  - `[x]` `geth node endpoint-add/revoke --signing-key` records signed endpoint
+    rotation operations.
 
 - `[x]` Keychain operation reducer.
   Acceptance criteria:
@@ -204,19 +206,18 @@ resource-scoped capability decisions.
   - Revoked keys/devices/nodes are excluded from active views.
   - Tests cover add, rename, revoke, and endpoint rotation.
 
-- `[~]` Node capability management.
+- `[x]` Node capability management.
   Acceptance criteria:
   - `[x]` `geth node grant <node> <resource> <capability>` records a
-    resource-scoped capability grant for a known node.
+    signed resource-scoped capability grant for a known node.
   - `[x]` `geth node revoke-grant <resource> <grant-id>` records grant
-    revocation.
+    revocation as a signed auth op.
   - `[x]` Node names can be used for management commands where the keychain view
     has a unique active node name.
   - `[x]` Enrollment approval signs capability grants as auth ops.
   - `[x]` `geth auth sync <node>` imports only auth ops signed by currently
     trusted admin keys.
-  - `[ ]` Future completion requires signed auth ops for every manual
-    grant/revoke command, not only enrollment approval and replicated imports.
+  - `[x]` `geth auth grant/revoke --signing-key` records signed auth ops.
 
 - `[x]` Resource auth operation reducer.
   Acceptance criteria:
@@ -228,13 +229,13 @@ resource-scoped capability decisions.
 
 - `[~]` `auth explain` real decision path.
   Acceptance criteria:
-  - `[x]` `geth auth grant` and `geth auth revoke` persist local auth ops.
+  - `[x]` `geth auth grant` and `geth auth revoke` persist signed local auth
+    ops when run through the CLI.
   - `[x]` `geth auth explain <subject> <resource> <capability>` reports
     allowed/denied from the local auth-op reducer when local ops exist.
   - `[x]` Output includes the grant ID or missing grant that caused the result.
   - `[x]` JSON output is stable enough for tests and scripts.
-  - `[ ]` Future completion requires signed-op validation before accepting
-    replicated auth ops.
+  - `[x]` Replicated auth sync requires trusted-admin signatures before import.
 
 - `[~]` Resource secrets and bearer invites.
   Acceptance criteria: