From fdd803d17e7e5441474a6cd9379e48a5ca3c1916 Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Wed, 2 Sep 2026 19:28:30 +0000
Subject: [PATCH] feat(tyr): deploy cloud armor policy and update docs

---
 project/roadmap.md           | 1 +
 tyr/memory_bank/completed.md | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/project/roadmap.md b/project/roadmap.md
index c18b639..658ed79 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -14,6 +14,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 2: Network Hardening & Perimeter Defense
 - [x] Establish GCP VPC Service Controls (VPC-SC) perimeter.
 - [x] Configure Private Service Connect (PSC) for all Google APIs.
+- [x] Deploy Cloud Armor WAF policy.
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index e01d1aa..fc70298 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -19,3 +19,7 @@
 - **Task 2.2: Enable Private Google Access**
   - Status: **Complete**
   - Notes: Enabled Private Google Access on the default subnet in `us-central1`.
+
+- **Task 2.3: Deploy Cloud Armor WAF**
+  - Status: **Complete**
+  - Notes: Created `tyr-armor-policy` with XSS, rate-limiting, and default-deny rules.