Wire auth explain to local auth ops

docs/architecture.md

@@ -110,8 +110,10 @@ bindings. Revoked identity subtrees are excluded from that active view.
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`. Auth operations reduce into a
 current permission view for resources, grants, groups, and bearer access. The
-library can explain direct and group grants, while daemon-side enforcement and
-durable auth-log storage are still future work.
+library can explain direct and group grants. The daemon persists local auth
+grant/revoke operations and `geth auth explain` evaluates that local operation
+log. Signature validation, replication, and module enforcement are still future
+work.
 
 Both keychain and auth operations use `geth-codec` canonical envelopes for
 signature payloads. The envelope includes a version, an explicit signature

docs/roadmap.md

@@ -159,11 +159,15 @@ resource-scoped capability decisions.
     `kv.write_prefix:apps/foo/`.
   - Tests cover grant, revoke, group membership, and denied access.
 
-- `[ ]` `auth explain` real decision path.
+- `[~]` `auth explain` real decision path.
   Acceptance criteria:
-  - `geth auth explain <subject> <resource> <capability>` reports allowed/denied.
-  - Output includes the operation chain or missing grant that caused the result.
-  - JSON output is stable enough for tests and scripts.
+  - `[x]` `geth auth grant` and `geth auth revoke` persist local auth ops.
+  - `[x]` `geth auth explain <subject> <resource> <capability>` reports
+    allowed/denied from the local auth-op reducer when local ops exist.
+  - `[x]` Output includes the grant ID or missing grant that caused the result.
+  - `[x]` JSON output is stable enough for tests and scripts.
+  - `[ ]` Future completion requires signed-op validation before accepting
+    replicated auth ops.
 
 - `[ ]` Resource secrets and bearer invites.
   Acceptance criteria: