Preflight infra gaps: Cloud Armor, Alertmanager webhooks, cosign + Binary Authorization, hub HSTS

[dantaik]

Context

Four operational gaps that are individually small but together block GA. All have concrete remediations and code-side scaffolding already in place — the missing piece is the operator pulling them together.

Acceptance criteria

Cloud Armor policy (INF-02)

• Provision pico-hub-armor security policy via gcloud compute security-policies create pico-hub-armor with the rules already documented in infra/k8s/01-hub.yaml:107-124 (XSS, SQLi, default rate-limit 100 req/min per IP).
• Apply the rules; confirm BackendConfig in 01-hub.yaml:140 references the live policy.
• Verify with a synthetic XSS / SQLi probe that the LB returns 403.

Alertmanager webhook secrets (INF-01)

• Populate .secrets/monitoring-prod.env with real ALERTMANAGER_DEFAULT_WEBHOOK_URL, ALERTMANAGER_PAGER_WEBHOOK_URL, ALERTMANAGER_TRIAGE_WEBHOOK_URL (PagerDuty, Slack, triage destination).
• Run infra/k8s/secrets-bootstrap.sh --bootstrap-monitoring --env-file .secrets/monitoring-prod.env.
• Verify Alertmanager loads the secret (no url_file read errors in pod logs).
• Cross-reference with the paging drill issue.

Cosign signing + Binary Authorization (INF-03)

• Provision a Cloud KMS-backed cosign key in the production GCP project; granted only to the deploy SA.
• Set COSIGN_PRIVATE_KEY repo secret to the KMS reference (preferred over raw blob).
• Re-tag the next release; verify both hub + watchtower images carry a cosign signature.
• Enable Binary Authorization on the cluster with a policy requiring signatures from the production cosign key.
• Confirm unsigned image deploys are rejected.

Hub HSTS header (RT-04)

• Add a Fastify middleware in apps/hub/src/server.ts that emits Strict-Transport-Security: max-age=63072000; includeSubDomains; preload on every response.
• Add a unit test for the header.
• Submit hub.pico.taiko.xyz to https://hstspreload.org once verified in production.

Severity

High — GA blocker. None require deep engineering; together they remove silent-degradation risks and meet the security-hardening bar a USDC-supporting public hub should clear.

Evidence pointers

• final_readiness_report.html §7.3 (INF-01, INF-02, INF-03), §4.4 RT-04, §13.1 item 6.
• infra/k8s/01-hub.yaml:107-152, infra/k8s/04-alertmanager.yaml:39-52, .github/workflows/gke-images.yml:217-243.