Add smooth node enrollment flow

docs/adr/0016-owner-node-enrollment.md

@@ -26,10 +26,24 @@ list`. Renames and revocations are additional keychain operations. Resource
 permissions remain resource-scoped auth operations and can be managed with
 `geth node grant` and `geth node revoke-grant`.
 
+New nodes can request enrollment with `geth node enroll request`. The request is
+signed by the requesting agent key and includes the stable node ID, agent ID,
+requested node name, optional endpoint ID, and requested resource capabilities.
+The request can be submitted over Iroh with `geth node enroll submit` or moved
+as a JSON file and imported on the owner machine.
+
+The owner approves with `geth node enroll approve --signing-key <key>`. Approval
+records signed keychain operations for the device, node, agent binding, and
+endpoint binding, plus signed auth operations for approved capabilities. The
+requesting node can run `geth node enroll sync <owner-node>` to pull both signed
+logs.
+
 `geth keychain sync <node>` pulls keychain operations and signatures over Iroh
 from an imported peer. The receiver imports only operations with valid OpenSSH
 signatures from currently trusted admin keys over the canonical keychain
-payload. Discovery and peer cards still grant no trust by themselves.
+payload. `geth auth sync <node>` applies the same trusted-admin signature rule
+to resource auth operations. Discovery and peer cards still grant no trust by
+themselves.
 
 ## Consequences
 
@@ -37,6 +51,7 @@ Node names are convenience labels over stable node IDs. Endpoint rotation should
 add or revoke endpoint bindings without replacing the node identity.
 
 The current sync model is a pull-based signed operation log. It is not yet a
-Keyhive-style convergent authority, does not implement advanced group
-cryptography, and does not yet sign/verify replicated auth operations. Those are
-future roadmap items.
+Keyhive-style convergent authority and does not implement advanced group
+cryptography. Manual grant/revoke commands still need the same signing
+requirement as enrollment approval before this becomes a complete authorization
+workflow.

docs/architecture.md

@@ -288,13 +288,24 @@ only operations with a valid OpenSSH signature from a currently trusted admin ke
 over the canonical payload. This is currently a pull-based signed operation log,
 not a CRDT or Keyhive-style convergent authority.
 
+New devices can use the node enrollment flow instead of hand-editing keychain
+state. `geth node enroll request` creates a canonical, agent-key-signed request
+containing the requesting node ID, agent ID, requested node name, optional Iroh
+endpoint, and requested resource capabilities. The request can be submitted over
+Iroh to an imported owner peer or moved as a JSON file to the owner machine.
+`geth node enroll approve` runs on the owner/YubiKey machine and records signed
+keychain operations for the device/node/agent/endpoint binding plus signed auth
+operations for approved capabilities. `geth node enroll sync <owner-node>` pulls
+both signed logs so the new node can see its approved identity and permissions.
+
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`. Auth operations reduce into a
 current permission view for resources, grants, groups, and bearer access. The
 library can explain direct and group grants. The daemon persists local auth
 grant/revoke operations and `geth auth explain` evaluates that local operation
-log. Signature validation, replication, and module enforcement are still future
-work.
+log. Enrollment approval and auth sync attach and verify OpenSSH admin
+signatures for replicated auth operations. Broader delegated authority and
+module enforcement are still future work.
 
 Capability evaluation supports exact matches plus explicit scoped forms. For KV,
 `kv.write_prefix:<prefix>` grants writes requested as `kv.write_key:<key>` only

docs/roadmap.md

@@ -188,6 +188,14 @@ resource-scoped capability decisions.
   - `[x]` `geth node rename/revoke` require an admin signing key.
   - `[x]` `geth keychain sync <node>` verifies signatures from currently
     trusted admin keys before accepting keychain ops.
+  - `[x]` `geth node enroll request` creates an agent-key-signed enrollment
+    request with requested node name and capabilities.
+  - `[x]` `geth node enroll submit/import/list` moves pending enrollment
+    requests over Iroh or JSON file for owner review.
+  - `[x]` `geth node enroll approve --signing-key` records signed keychain ops
+    for device/node/agent/endpoint enrollment.
+  - `[x]` `geth node enroll sync <owner-node>` pulls approved signed keychain
+    and auth state onto the requesting node.
 
 - `[x]` Keychain operation reducer.
   Acceptance criteria:
@@ -204,8 +212,11 @@ resource-scoped capability decisions.
     revocation.
   - `[x]` Node names can be used for management commands where the keychain view
     has a unique active node name.
-  - `[ ]` Future completion signs auth ops and verifies signed auth ops before
-    accepting replicated permission changes.
+  - `[x]` Enrollment approval signs capability grants as auth ops.
+  - `[x]` `geth auth sync <node>` imports only auth ops signed by currently
+    trusted admin keys.
+  - `[ ]` Future completion requires signed auth ops for every manual
+    grant/revoke command, not only enrollment approval and replicated imports.
 
 - `[x]` Resource auth operation reducer.
   Acceptance criteria: