Add bearer challenge-response proofs

docs/architecture.md

@@ -268,8 +268,11 @@ key envelopes, bearer secrets, and rotation. Revocation for private data is
 modeled initially as secret epoch rotation. The daemon persists resource secret
 epoch metadata through `secret create/rotate/status`. Bearer access is recorded
 as resource-scoped auth operations and rejects trust-mutation capabilities such
-as `auth.delegate`, `auth.revoke`, and `node.enroll`. The daemon does not yet
-store payload key material, encrypt resource data, or distribute key envelopes.
+as `auth.delegate`, `auth.revoke`, and `node.enroll`. Bearer challenge/proof
+commands derive deterministic BLAKE3 keyed responses from the bearer secret,
+resource, nonce, and requested capabilities, then verify them against active
+resource-scoped bearer grants. The daemon does not yet store payload key
+material, encrypt resource data, or distribute key envelopes.
 
 ## Multi-User Direction
 

docs/roadmap.md

@@ -220,8 +220,11 @@ resource-scoped capability decisions.
   - `[x]` Bearer secrets grant only resource-scoped capabilities.
   - `[x]` Bearer principals cannot mutate trust graph state by default.
   - `[x]` Tests verify bearer access does not imply node identity.
-  - `[ ]` Future completion requires bearer challenge-response proof instead
-    of metadata-only local records.
+  - `[x]` `geth secret bearer challenge/prove/verify` exercises
+    resource-scoped bearer challenge-response proofs.
+  - `[x]` Tests verify valid bearer proofs and capability-scoped proof denial.
+  - `[ ]` Future completion wires bearer proof verification into remote module
+    authorization paths.
 
 - `[~]` SSH certificate and revocation lifecycle.
   Acceptance criteria: