From e6c131758bb54e9142b7369963a78cb89dc600d4 Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Wed, 2 Sep 2026 19:14:15 +0000
Subject: [PATCH] refactor(tyr): draft binauthz policy and update roadmap

---
 project/roadmap.md           |  2 +-
 tyr/memory_bank/completed.md |  4 ++--
 tyr/policy/binauthz.yaml     | 15 ++++++++++++++-
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/project/roadmap.md b/project/roadmap.md
index eb9a503..89d68d2 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -9,7 +9,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
 - [x] Deploy step-ca
 - [x] Bootstrap SPIRE
-- [x] Establish Binary Authorization Infrastructure
+- [~] Establish Binary Authorization Infrastructure (staged, pending attestor creation)
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index 95dcc94..bfce9b6 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -9,5 +9,5 @@
   - Notes: `install_spire.sh` executed and daemons are running.
 
 - **Phase 1.4: Binary Authorization**
-  - Status: **Complete**
-  - Notes: `cosign` installed, KMS key generated, and initial `binauthz.yaml` policy exported.
+  - Status: **Staged**
+  - Notes: Policy YAML drafted, but blocked on creation of a KMS-based attestor resource.
diff --git a/tyr/policy/binauthz.yaml b/tyr/policy/binauthz.yaml
index 8c39197..b16a243 100644
--- a/tyr/policy/binauthz.yaml
+++ b/tyr/policy/binauthz.yaml
@@ -1,5 +1,18 @@
 defaultAdmissionRule:
+  evaluationMode: REQUIRE_ATTESTATION
   enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
-  evaluationMode: ALWAYS_ALLOW
+  requireAttestationsBy:
+    - projects/propane-will-491900-m5/attestors/tyr-kms-attestor
 globalPolicyEvaluationMode: ENABLE
 name: projects/propane-will-491900-m5/policy
+attestationAuthorities:
+  "projects/propane-will-491900-m5/attestors/tyr-kms-attestor":
+    userOwnedGrafeasNote:
+      noteReference: "projects/propane-will-491900-m5/notes/cosign-attestor-note" # NOTE: This is a placeholder
+      publicKeys:
+        - pkixPublicKey:
+            publicKeyPem: |-
+              -----BEGIN PUBLIC KEY-----
+              MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj
+              j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA==
+              -----END PUBLIC KEY-----