Implement resource auth reducer

docs/architecture.md

@@ -108,7 +108,10 @@ admin keys, users, devices, node records, agent bindings, and endpoint-to-node
 bindings. Revoked identity subtrees are excluded from that active view.
 
 The authorization plane is `geth-auth`: resource-local signed operation logs,
-grants, revocations, groups, and `auth explain`.
+grants, revocations, groups, and `auth explain`. Auth operations reduce into a
+current permission view for resources, grants, groups, and bearer access. The
+library can explain direct and group grants, while daemon-side enforcement and
+durable auth-log storage are still future work.
 
 Both keychain and auth operations use `geth-codec` canonical envelopes for
 signature payloads. The envelope includes a version, an explicit signature

docs/roadmap.md

@@ -151,7 +151,7 @@ resource-scoped capability decisions.
   - Revoked keys/devices/nodes are excluded from active views.
   - Tests cover add, rename, revoke, and endpoint rotation.
 
-- `[ ]` Resource auth operation reducer.
+- `[x]` Resource auth operation reducer.
   Acceptance criteria:
   - Resource create, authority set, grants, revocations, and groups reduce into
     a current permission view.