refactor(tyr): draft binauthz policy and update roadmap

project/roadmap.md

@@ -9,7 +9,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
 - [x] Deploy step-ca
 - [x] Bootstrap SPIRE
-- [x] Establish Binary Authorization Infrastructure
+- [~] Establish Binary Authorization Infrastructure (staged, pending attestor creation)
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.

tyr/memory_bank/completed.md

@@ -9,5 +9,5 @@
   - Notes: `install_spire.sh` executed and daemons are running.
 
 - **Phase 1.4: Binary Authorization**
-  - Status: **Complete**
+  - Status: **Staged**
-  - Notes: `cosign` installed, KMS key generated, and initial `binauthz.yaml` policy exported.
+  - Notes: Policy YAML drafted, but blocked on creation of a KMS-based attestor resource.

tyr/policy/binauthz.yaml

@@ -1,5 +1,18 @@
 defaultAdmissionRule:
+  evaluationMode: REQUIRE_ATTESTATION
   enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
-  evaluationMode: ALWAYS_ALLOW
+  requireAttestationsBy:
+    - projects/propane-will-491900-m5/attestors/tyr-kms-attestor
 globalPolicyEvaluationMode: ENABLE
 name: projects/propane-will-491900-m5/policy
+attestationAuthorities:
+  "projects/propane-will-491900-m5/attestors/tyr-kms-attestor":
+    userOwnedGrafeasNote:
+      noteReference: "projects/propane-will-491900-m5/notes/cosign-attestor-note" # NOTE: This is a placeholder
+      publicKeys:
+        - pkixPublicKey:
+            publicKeyPem: |-
+              -----BEGIN PUBLIC KEY-----
+              MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj
+              j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA==
+              -----END PUBLIC KEY-----