From 8eac8a912f4265a14031e2d92c081941816a4341 Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Wed, 2 Sep 2026 19:11:10 +0000
Subject: [PATCH] feat(tyr): complete binary authorization setup and update
 docs

---
 cosign.pub                   | 4 ++++
 project/roadmap.md           | 1 +
 tyr/memory_bank/completed.md | 4 ++++
 tyr/policy/binauthz.yaml     | 5 +++++
 4 files changed, 14 insertions(+)
 create mode 100644 cosign.pub
 create mode 100644 tyr/policy/binauthz.yaml

diff --git a/cosign.pub b/cosign.pub
new file mode 100644
index 0000000..c4eaa88
--- /dev/null
+++ b/cosign.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj
+j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA==
+-----END PUBLIC KEY-----
diff --git a/project/roadmap.md b/project/roadmap.md
index fac7cae..eb9a503 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -9,6 +9,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
 - [x] Deploy step-ca
 - [x] Bootstrap SPIRE
+- [x] Establish Binary Authorization Infrastructure
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index 7425393..95dcc94 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -7,3 +7,7 @@
 - **Phase 1.2: Bootstrap SPIRE**
   - Status: **Complete**
   - Notes: `install_spire.sh` executed and daemons are running.
+
+- **Phase 1.4: Binary Authorization**
+  - Status: **Complete**
+  - Notes: `cosign` installed, KMS key generated, and initial `binauthz.yaml` policy exported.
diff --git a/tyr/policy/binauthz.yaml b/tyr/policy/binauthz.yaml
new file mode 100644
index 0000000..8c39197
--- /dev/null
+++ b/tyr/policy/binauthz.yaml
@@ -0,0 +1,5 @@
+defaultAdmissionRule:
+  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
+  evaluationMode: ALWAYS_ALLOW
+globalPolicyEvaluationMode: ENABLE
+name: projects/propane-will-491900-m5/policy