Improve auth explain diagnostics

docs/roadmap.md

@@ -16,7 +16,7 @@ end-to-end test target for the intended personal mesh use cases.
 
 Implementation order:
 
-1. `[~]` Close remote authorization and replicated-state safety gaps.
+1. `[x]` Close remote authorization and replicated-state safety gaps.
    Acceptance criteria:
    - `[x]` Add initial two-daemon tests proving denied remote pubsub publish,
      remote pipe listen, and SSH admin shell requests do not mutate serving
@@ -27,7 +27,7 @@ Implementation order:
      keychain/auth operations are rejected and not imported.
    - `[x]` Add tests proving conflicting replicated keychain/auth records do
      not mutate trust/resource state.
-   - `[ ]` Improve `auth explain` diagnostics enough for operators to
+   - `[x]` Improve `auth explain` diagnostics enough for operators to
      distinguish discovered-only peers, missing endpoint bindings, missing
      grants, matching grants, revocations, and bearer access.
 
@@ -86,7 +86,7 @@ Implementation order:
     pubsub, pipe, SSH proxy/admin shell, SSH cert metadata, and revocations.
   - `[x]` Initial two-daemon denied-mutation coverage exists for remote pubsub
     publish, remote pipe listen, and SSH admin shell.
-  - `[ ]` `auth explain` output can explain discovered-only peers, missing
+  - `[x]` `auth explain` output can explain discovered-only peers, missing
     endpoint bindings, missing grants, matching grants, revocations, and bearer
     access.
 
@@ -364,6 +364,9 @@ resource-scoped capability decisions.
   - `[x]` Output includes the grant ID or missing grant that caused the result.
   - `[x]` JSON output is stable enough for tests and scripts.
   - `[x]` Replicated auth sync requires trusted-admin signatures before import.
+  - `[x]` Human and JSON output include diagnostics for discovered-only peers,
+    missing and matched endpoint bindings, matching grants, revoked grants, and
+    bearer access.
 
 - `[~]` Resource secrets and bearer invites.
   Acceptance criteria: