Separate bearer ids from private tokens

docs/roadmap.md

@@ -227,8 +227,12 @@ resource-scoped capability decisions.
     the requested resource capability without granting node identity.
   - `[x]` Tests verify remote CAS fetch succeeds through a bearer proof before
     the caller has a node grant.
-  - `[ ]` Future completion avoids sending bearer secret identifiers as proof
-    material by separating public bearer ids from private bearer tokens.
+  - `[x]` Bearer creation separates the persisted public bearer id from the
+    private bearer token returned to the caller.
+  - `[x]` Bearer list/revoke operate on public bearer ids while proof and remote
+    authorization use the private token.
+  - `[x]` Tests verify the public bearer id differs from the private token and
+    remote bearer auth uses the token.
 
 - `[~]` SSH certificate and revocation lifecycle.
   Acceptance criteria: