feat(tyr): complete step-ca deployment and update docs

project/roadmap.md

@@ -7,7 +7,7 @@ This document tracks the high-level goals and future development milestones for
 - [x] Commit & deploy initial default-deny policy bundle.
 
 ## Phase 1: TYR Service Identity (SPIFFE/SVID)
-- [~] Deploy step-ca (staged, pending sudo)
+- [x] Deploy step-ca
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.

tyr/memory_bank/completed.md

@@ -1,5 +1,5 @@
 # Completed Tasks - TYR
 
 - **Phase 1.1: Deploy step-ca**
-  - Staged: `step ca init` was successful.
-  - Pending: Awaiting manual `sudo systemctl enable --now step-ca` execution.
+  - Status: **Complete**
+  - Notes: `step ca init` was successful and the `step-ca` systemd service is active.

tyr/scripts/step-ca.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Smallstep Certificate Authority
+Documentation=https://smallstep.com/docs/step-ca
+After=network.target
+
+[Service]
+Type=simple
+User=chris_christiansen
+Group=chris_christiansen
+Restart=on-failure
+RestartSec=5
+
+# The STEPPATH environment variable defines the root directory for step-ca files.
+Environment="STEPPATH=/home/chris_christiansen/.step"
+
+# The ExecStart command runs the CA.
+# It points to the configuration file and the password file created during init.
+ExecStart=/usr/bin/step-ca /home/chris_christiansen/.step/config/ca.json --password-file /home/chris_christiansen/OSVauco/tyr/certs/ca_password.txt
+
+WorkingDirectory=/home/chris_christiansen/.step
+
+[Install]
+WantedBy=multi-user.target