@typecad/framework-zephyr 1.0.0-alpha.15 → 1.0.0-alpha.18

package/src/doctor.ts

@@ -1,7 +1,7 @@
 // ---------------------------------------------------------------------------
 // @typecad/framework-zephyr — Zephyr environment doctor
 //
-// `cuttlefish doctor` (Zephyr framework) — verify west (the Zephyr build tool)
+// `typecad-hal doctor` (Zephyr framework) — verify west (the Zephyr build tool)
 // is installed + responsive, the Zephyr RTOS is inside the framework's declared
 // compat range, and the configured board target exists in the checkout. Exits 0
 // if the environment is OK, non-zero otherwise. Follows the same contract
@@ -12,7 +12,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import * as ui from '@typecad/cuttlefish/utils/ui';
-import { loadCuttlefishConfig } from '@typecad/cuttlefish/config-loader';
+import { loadTypecadConfig } from '@typecad/cuttlefish/config-loader';
 import { checkZephyrEnv } from './toolchain/env-check.js';
 import { PINNED_ZEPHYR_MANIFEST_REV, PINNED_ZEPHYR_SDK_VERSION, sdkFingerprint } from '@typecad/cuttlefish/board-catalog';
 import { resolveChipFromBoard } from './chips/resolve.js';
@@ -26,7 +26,7 @@ export function runDoctor(): void {
   ui.printHeader();
   ui.printStep('Checking Zephyr environment...');
 
-  const config = loadCuttlefishConfig(process.cwd());
+  const config = loadTypecadConfig(process.cwd());
   const buildTarget = config?.buildTarget;
 
   const result = checkZephyrEnv(buildTarget);
@@ -71,7 +71,7 @@ export function runDoctor(): void {
       ui.printInfo(`Board target .... ${buildTarget}${arrow}`);
     }
   } else {
-    ui.printInfo('(no buildTarget in cuttlefish.config.ts — skipping board check)');
+    ui.printInfo('(no buildTarget in typecad-hal.config.ts — skipping board check)');
   }
 
   // Probe methods — from the board package's table, via the board constants

package/src/dt-config/custom-board.ts

@@ -94,7 +94,7 @@ export function generateCustomBoard(
         '# package (or add a board package) instead of this file.',
         'board:',
         `  name: ${name}`,
-        `  full_name: Cuttlefish custom board (${chip.soc})`,
+        `  full_name: TypeCAD custom board (${chip.soc})`,
         `  vendor: ${CUSTOM_BOARD_VENDOR}`,
         '  socs:',
         `    - name: ${soc}`,
@@ -126,7 +126,7 @@ export function generateCustomBoard(
     ...cb.dtsIncludes.map((inc) => `#include <${inc}>`),
     '',
     '/ {',
-    `	model = "Cuttlefish custom board (${chip.soc})";`,
+    `	model = "TypeCAD custom board (${chip.soc})";`,
     `	compatible = "${CUSTOM_BOARD_VENDOR},${name.replace(/_/g, '-')}";`,
     '',
     '	chosen {',

package/src/dt-config/kconfig.ts

@@ -341,12 +341,16 @@ export function resolveKconfigFragments(
     // pinned-CA handshake fails with EPERM at connect (the insecure path
     // skips verification, so it works either way).
     m.set('CONFIG_MBEDTLS_X509_CRT_PARSE_C', 'y');
-    // KNOWN LIMITATION on this Zephyr tree: pinned-CA (verified TLS) fails at
-    // connect — the tf-psa-crypto mbedTLS needs a wider symbol matrix
-    // (RSA public-key parse + PEM/DER glue) than the single-ciphersuite
-    // select pulls in, and forcing the extra symbols regresses the insecure
-    // path. insecure() HTTPS is fully verified; caCert() chain verification
-    // stays open until the upstream matrix is mapped.
+    // KNOWN LIMITATION on this Zephyr tree: pinned-CA (verified TLS) was
+    // observed failing at connect with EPERM — the tf-psa-crypto mbedTLS
+    // needs a wider symbol matrix (RSA public-key parse + PEM/DER glue)
+    // than the single-ciphersuite select pulls in, and forcing the extra
+    // symbols regressed the insecure path (two hardware cycles proved it
+    // upstream). CAVEAT: that diagnosis predates the 2026-09 fix of the
+    // request-fact reset ordering (every option — including caCert — was
+    // being wiped before each send, which alone reproduces connect
+    // failures); the matrix limitation needs a hardware re-run to confirm
+    // it still applies. insecure() HTTPS and no-CA https are unaffected.
     // Handshake/protocol buffers allocate from the mbedTLS heap; MBEDTLS_HEAP_SIZE
     // must hold ~2x MBEDTLS_SSL_MAX_CONTENT_LEN plus working state. 65000 fits on
     // the ESP32; mbedTLS requires the full libc and PEM (not DER) cert format.
@@ -400,12 +404,14 @@ export function resolveKconfigFragments(
     // pinned-CA handshake fails with EPERM at connect (the insecure path
     // skips verification, so it works either way).
     m.set('CONFIG_MBEDTLS_X509_CRT_PARSE_C', 'y');
-    // KNOWN LIMITATION on this Zephyr tree: pinned-CA (verified TLS) fails at
-    // connect — the tf-psa-crypto mbedTLS needs a wider symbol matrix
-    // (RSA public-key parse + PEM/DER glue) than the single-ciphersuite
-    // select pulls in, and forcing the extra symbols regresses the insecure
-    // path. insecure() HTTPS is fully verified; caCert() chain verification
-    // stays open until the upstream matrix is mapped.
+    // KNOWN LIMITATION on this Zephyr tree: pinned-CA (verified TLS) was
+    // observed failing at connect with EPERM — the tf-psa-crypto mbedTLS
+    // needs a wider symbol matrix (RSA public-key parse + PEM/DER glue)
+    // than the single-ciphersuite select pulls in. CAVEAT: that diagnosis
+    // was made on the HTTPS path and predates the 2026-09 request-fact
+    // reset-ordering fix (options were wiped before every send, which
+    // alone reproduces connect failures); it is shared here because mqtts
+    // pins its CA through the same matrix — re-verify on hardware.
     m.set('CONFIG_MBEDTLS_ENABLE_HEAP', 'y');
     // 2x SSL_MAX_CONTENT_LEN record buffers + CA-chain parse state +
     // handshake working memory. 65000 fit insecure-mode handshakes but the