Authorize remote modules with bearer proofs

AGENTS.md

@@ -179,8 +179,10 @@ Roadmap items should be actionable and checkable:
   Bearer access metadata can be created/listed/revoked as resource-scoped auth
   ops and must not allow trust graph mutation capabilities. Bearer
   challenge/proof/verify commands exist for resource-scoped possession checks.
-  Payload encryption, key envelopes, and wiring bearer proofs into remote module
-  authorization are still roadmap work.
+  Remote module authorization paths can accept optional bearer proofs without
+  enrolling the caller as a trusted node. Payload encryption, key envelopes, and
+  separating public bearer ids from private bearer tokens are still roadmap
+  work.
 - SSH revocations can be exported as JSONL, OpenSSH KRL specification text, or
   binary OpenSSH KRL files generated through `ssh-keygen`. JSONL and OpenSSH KRL
   specification imports are supported; binary KRL import is unsupported because