tan-cli 0.7.0__py3-none-any.whl

tan/planner/topology.py

@@ -0,0 +1,208 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Per-core OS-class taxonomy + the topology view (issue #95).
+
+A core's runtime is fixed by its Cortex class -- Cortex-A -> Yocto (Linux),
+Cortex-M -> Zephyr (RTOS) -- not chosen freely. This module owns the
+allowed-OS set read from the board schema, plus `core_os_topology` /
+`emit_os_topology`, the per-core OS facts an IDE/tool renders. Extracted from
+alp_orchestrate as the #285 topology seam and re-exported from the package
+__init__, so callers + alp_project.py keep importing the same names unchanged.
+
+The default-OS rule itself (`_default_os_from_core_type` / `CLASS_RUNTIMES` /
+`_cross_class_os` below) is IMPORTED, not defined here, as of tan-cli#870:
+`tan.core.os_class` now owns it, re-exported under these same names so every
+caller and test that already imports them from this module is unaffected. See
+that module's docstring for why the rule moved somewhere `tan.planner`'s
+process-global SDK-root binding cannot reach -- `tan presets`' `allowedOs`
+field needs the identical convention without paying this package's bind-first
+import cost.
+"""
+
+from __future__ import annotations
+
+import functools
+import json
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from tan.core.document_guards import DocumentGuards
+from tan.core.os_class import CLASS_RUNTIMES  # noqa: F401  (re-export: unchanged public name)
+from tan.core.os_class import allowed_os_for_core as _allowed_os_for_core_shared
+from tan.core.os_class import cross_class_os as _cross_class_os  # noqa: F401  (re-export: validate.py's `from .topology import ... _cross_class_os`)
+from tan.core.os_class import default_os_from_core_type as _default_os_from_core_type
+
+from .models import OrchestratorError
+from .paths import BOARD_SCHEMA
+
+#: The malformed-document register, bound to THIS module's curated class.
+_GUARDS = DocumentGuards(OrchestratorError)
+
+if TYPE_CHECKING:
+    from .models import BoardProject
+
+
+@functools.lru_cache(maxsize=None)
+def _core_os_choices(metadata_root: Path) -> tuple[str, ...]:
+    """The runtimes a core's `os:` may resolve to, read from *metadata_root*'s
+    board schema's `$defs/core_entry/properties/os` enum.
+
+    Derived (not re-typed) so the value-set has exactly one source of truth
+    and cannot drift between the schema and the code.  `off` skips the core
+    (no slice is built).  *metadata_root* is REQUIRED and the cache is keyed
+    on it -- a fixed in-tree default here silently ignored a project's
+    `--metadata-root` override (#1485).
+
+    Falls back to the in-tree `BOARD_SCHEMA` when *metadata_root* has no
+    `schemas/` of its own (e.g. a synthetic test root) -- the same fallback
+    `loader._validate_board` applies, so a scratch root without a schema copy
+    still resolves instead of raising a raw `FileNotFoundError`.
+
+    RELOCATED divergence from alp-sdk's own `scripts/alp_orchestrate/
+    topology.py` (tan-cli#1162), which still spells the lines below as two
+    `is_file()` pre-flights and a bare `json.loads(read_text(...))`. Two
+    defects lived in that, and only one is the bare read the issue names:
+
+    * The fallback pre-flight is not a guard but a SELECTOR, and
+      `is_file()` answered `False` to "denied" and "is a directory"
+      exactly as to "not there" -- so an unreadable project schema fell
+      back silently onto a DIFFERENT document and the caller was told an
+      `os:` set the project never declared. `read_optional_text`
+      classifies on the real exception: `ENOENT`/`ENOTDIR` is the legal
+      no-schema-of-its-own branch, everything else is a refusal.
+    * On a `chmod 000` PARENT that pre-flight does not answer at all on
+      3.12.3/3.13.15 (`Path.is_file()` raises `PermissionError`; 3.14.7
+      returns `False` -- tan-cli#1127), so one unreadable schema was a raw
+      traceback on two interpreters and a silent wrong answer on the third.
+
+    CALLERS: `validate._enforce_loader_rules:343` via `loader.py:1009`, so
+    every `load_board_yaml` -- `tan build`, `tan validate`, `tan generate`,
+    `tan kconfig` -- plus `_allowed_os_for_core` below. On `tan build` the
+    raw exception was absorbed by `build_cmd.py:505` into a
+    `build.plan-unavailable` envelope naming the type, not the file.
+
+    The `$defs` chain uses `require_key` rather than bare subscript for the
+    same reason: a legal-JSON schema missing `core_entry`, or with a
+    non-list `enum`, reached `tuple()` as a raw `KeyError`/`TypeError`.
+    """
+    schema_path = Path(metadata_root) / "schemas" / "board.schema.json"
+    text = _GUARDS.read_optional_text(schema_path, what="board schema")
+    if text is None:
+        schema_path = BOARD_SCHEMA
+        text = _GUARDS.require_readable_text(
+            schema_path, what="board schema",
+            absent=f"board schema not found: {schema_path}")
+    schema = _GUARDS.require_json_mapping_doc(
+        text, path=schema_path, what="board schema")
+    defs = _GUARDS.require_key(
+        schema, "$defs", dict, doc=schema_path, field="board schema")
+    entry = _GUARDS.require_key(
+        defs, "core_entry", dict, doc=schema_path, field="$defs")
+    props = _GUARDS.require_key(
+        entry, "properties", dict, doc=schema_path, field="$defs.core_entry")
+    os_prop = _GUARDS.require_key(
+        props, "os", dict, doc=schema_path,
+        field="$defs.core_entry.properties")
+    return tuple(_GUARDS.require_key(
+        os_prop, "enum", list, doc=schema_path,
+        field="$defs.core_entry.properties.os"))
+
+
+def _runtime_class(core_type: str) -> str:
+    """`linux` for Cortex-A, `rtos` for Cortex-M, else `other`.
+
+    `core_type` is typed `str`, and today's one caller (`core_os_topology`)
+    already normalises a non-string `type` to `""` before this is reached
+    (`soc_types`'s `isinstance` guard, tan-cli#957/#962) -- so the
+    `isinstance` check below is defense-in-depth, not a live bug fix: it is
+    currently unreachable, not currently wrong. It is added anyway so this
+    shared-shaped helper does not repeat the exact assumption ("my caller
+    surely guarded this") that let the bare idiom survive unnoticed at both
+    `presets_cmd.core_type_lookup` and `kconfig._emit_inference` (tan-cli#962)
+    -- a future caller of this function gets the same backstop those two
+    now have, instead of inheriting the crash-or-leak choice again.
+    """
+    t = core_type.lower() if isinstance(core_type, str) else ""
+    if t.startswith("cortex-a"):
+        return "linux"
+    if t.startswith("cortex-m"):
+        return "rtos"
+    return "other"
+
+
+def _allowed_os_for_core(core_type: str, metadata_root: Path) -> list[str]:
+    """The os: values valid for this core: every runtime minus the other
+    class's OS -- e.g. Cortex-A -> [yocto, baremetal, off], Cortex-M ->
+    [zephyr, baremetal, off].
+
+    Delegates to `tan.core.os_class.allowed_os_for_core` (tan-cli#914) rather
+    than open-coding the same subtraction `_cross_class_os` performs: an
+    unresolved `core_type` (`""` -- `core_os_topology`'s own
+    `soc_types.get(core_id, "")`) degrades to `[]` there rather than the
+    plausible-but-wrong cross-class subtraction, the SAME degrade
+    `presets_cmd.allowed_os_lookup` needs -- see that function's docstring for
+    why the two must never drift apart on this again.
+
+    Upstream agrees: alp-sdk's `scripts/alp_orchestrate/topology.py` carries
+    the same `[]` guard for an unresolved `core_type` since alp-sdk#1852
+    (porting tan-cli#914 / tan-cli#957), so there is no divergence to record.
+    Do NOT reintroduce a `["baremetal", "off"]` guess here -- that is the
+    plausible-but-wrong answer #870/#914 exist to remove.  This reaches
+    `core_os_topology`'s `allowed_os` field, which `test_planner_emit_parity`
+    pins byte-for-byte against the oracle.
+    """
+    return _allowed_os_for_core_shared(core_type, _core_os_choices(metadata_root))
+
+
+def core_os_topology(project: "BoardProject") -> dict[str, Any]:
+    """Per-core OS facts for an IDE / tool (issue #95).
+
+    The runtime is *determined by the core class* -- Cortex-A -> Yocto (Linux),
+    Cortex-M -> Zephyr (RTOS) -- and is not user-selectable.  For each resolved
+    core this reports its `runtime_class`, the class `default_os`, the
+    `effective_os` (after a `baremetal`/`off` override -- the only board.yaml
+    knobs), whether it is `enabled`, and the per-core `allowed_os` set (the
+    valid dropdown).  Lets the Board Configurator show the SDK's selection +
+    the legal overrides instead of guessing or offering a cross-class OS.
+    """
+    # `c.get("type", "")` is UNVALIDATED against `soc-spec-v1.schema.json`'s
+    # own `"type": {"type": "string"}` -- the identical gap `presets_cmd.
+    # core_type_lookup` closed for tan-cli#957, same class, this call site
+    # pre-dating it. `core_type` below feeds `_runtime_class`/
+    # `_default_os_from_core_type`'s `(core_type or "").lower()` AND is
+    # written verbatim to the emitted `core_type` field, so a non-string
+    # here is an `AttributeError` (build/`--emit os-topology` abort) or a
+    # wire leak, same two failure modes. Normalises to the same `""`
+    # unresolved sentinel a missing `type`/entry already produces.
+    soc_types = {
+        c["id"]: c["type"] if isinstance(c.get("type"), str) else ""
+        for c in (project.soc_spec.get("cores") or []) if "id" in c
+    }
+    rows: list[dict[str, Any]] = []
+    for core_id, sl in sorted(project.cores.items()):
+        core_type = soc_types.get(core_id, "")
+        default_os = _default_os_from_core_type(core_type)
+        rows.append({
+            "core_id":       core_id,
+            "core_type":     core_type,
+            "runtime_class": _runtime_class(core_type),
+            "default_os":    default_os,
+            "effective_os":  sl.os,
+            "enabled":       sl.os != "off",
+            "overridden":    sl.os != default_os,
+            "allowed_os":    _allowed_os_for_core(
+                core_type, project.effective_metadata_root()),
+        })
+    return {
+        "schema_version": 1,
+        "sku":            project.sku,
+        "cores":          rows,
+    }
+
+
+def emit_os_topology(project: "BoardProject") -> str:
+    """JSON for `alp_project.py --emit os-topology` (see core_os_topology).
+
+    Sorted keys + a trailing newline so the output is byte-deterministic.
+    """
+    return json.dumps(core_os_topology(project), indent=2) + "\n"

tan/planner/validate.py

@@ -0,0 +1,365 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Cross-field validators (P2.1 + P2.3 of v0.6).
+
+The post-parse consistency rules over a resolved BoardProject / its slices: the
+curated-library + TLS-provider sets, boot-signing family support,
+`_validate_consistency` (the big cross-field pass), and the per-slice OS-class /
+loader-rule enforcement. Pure checks -- they read the model and raise
+OrchestratorError; nothing here mutates or emits. Extracted as the #285 validate
+seam. The OS-class taxonomy comes from topology.py.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+from typing import TYPE_CHECKING, Optional
+
+from . import libraries as _library_layer
+from .models import OrchestratorError, Slice
+from .orchestrator import STOCK_IMAGE_APP, STOCK_SHIM_APP
+from .paths import METADATA_ROOT, REPO
+from .topology import _core_os_choices, _cross_class_os
+
+if TYPE_CHECKING:
+    from .models import BoardProject  # noqa: F401
+
+
+def _curated_library_names(metadata_root: Path) -> frozenset[str]:
+    """The curated `libraries:` set, derived from the real registry instead
+    of hand-listed (alp-sdk #1197 WS6-c #610 §6): every
+    metadata/libraries/<name>.yaml manifest is reachable either via its
+    legacy token in metadata/library-aliases-v1.json
+    (`aliases: {token: canonical}`) or, absent an alias entry, via its own
+    name with hyphens folded to underscores.  This is the same reachability
+    rule alp-sdk's scripts/check_library_registry.py `_registry_vs_curated`
+    cross-checks this set against, so the two can no longer drift the way the
+    old hand-maintained frozenset did (9 curated libraries silently missing).
+    Used by `_validate_consistency()` to reject `extra_libraries:` slugs
+    that collide with the curated set (the curated library MUST be
+    declared via `libraries:` -- the escape hatch is for non-curated
+    entries only).
+
+    *metadata_root* is the BOUND alp-sdk checkout's `metadata/` -- the
+    registry is a fact and facts did not relocate (ADR-0017)."""
+    libdir = metadata_root / "libraries"
+    if not libdir.is_dir():
+        return frozenset()
+    manifests = {p.stem for p in libdir.glob("*.yaml")}
+    alias_p = metadata_root / "library-aliases-v1.json"
+    aliases: dict[str, str] = {}
+    if alias_p.is_file():
+        doc = json.loads(alias_p.read_text(encoding="utf-8"))
+        aliases = doc.get("aliases") or {}
+    reverse_alias = {canonical: token for token, canonical in aliases.items()}
+    return frozenset(reverse_alias.get(m, m.replace("-", "_")) for m in manifests)
+
+
+_CURATED_LIBRARIES: frozenset[str] = _curated_library_names(METADATA_ROOT)
+
+
+def _boot_signing_supported_for_family(
+    family: str,
+) -> Optional[frozenset[str]]:
+    """Return the allowed `boot.signing.algorithm:` values for a SoM
+    family, or None when the family is unknown (caller accepts any
+    schema-enum value).
+
+    Per the v0.6 P2.3 cross-field-validator pass:
+      - Alif Ensemble (with OPTIGA Trust M as attestation root):
+        `ecdsa_p256`, `ed25519` only.  RSA is excluded -- the OPTIGA
+        slot type paired with the AEN secure-boot flow is ECC-only.
+      - Renesas RZ/V2N (+ V2N + DEEPX): `ecdsa_p256`, `rsa2048`,
+        `rsa3072`.  ed25519 is excluded (not in the U-Boot
+        fit-signature stack used on V2N today).
+      - Unknown families: None (validator falls through to the schema
+        enum -- don't block on missing capability data for
+        in-development presets).
+    """
+    f = (family or "").lower()
+    if f.startswith("alif-ensemble"):
+        return frozenset({"ecdsa_p256", "ed25519"})
+    if f.startswith("renesas-rzv2n"):
+        return frozenset({"ecdsa_p256", "rsa2048", "rsa3072"})
+    return None
+
+
+# TLS providers acceptable for `cores.<id>.iot.tls: true` (rule 3).
+# A library named `mbedtls` or `bearssl` in either `libraries:` or
+# `extra_libraries:` satisfies the requirement.
+_TLS_PROVIDERS: frozenset[str] = frozenset({"mbedtls", "bearssl"})
+
+
+def _validate_consistency(project: "BoardProject") -> None:
+    """Cross-field validation that the schema can't express cleanly.
+
+    Runs after the project is fully assembled by `load_board_yaml()`.
+    Raises `OrchestratorError` for hard violations; emits stderr
+    `WARN: ...` lines for soft signals (rules 4 + 5).
+
+    Rules (v0.6 P2.3):
+
+    1. `ota.provider: mender` requires at least one
+       `cores.<id>.os: yocto` slice.  Reason: server-mode Mender is a
+       Yocto-only flow today; the Zephyr-side dispatch
+       (Mender-MCU-client) lands separately per ADR 0009.
+    2. `boot.signing.algorithm:` must be in the SoM family's supported
+       set (see `_boot_signing_supported_for_family`).  Unknown
+       families pass through (don't block on missing capability data).
+    3. `cores.<id>.iot.tls: true` requires `libraries:` (curated,
+       project-wide OR `cores:`-scoped -- both channels checked via
+       `libraries.scoped_names`, #1359 follow-up) OR `extra_libraries:`
+       (open-set) to include `mbedtls` or `bearssl`.
+    4. WARNING (not error): `cores.<id>.inference.default_arena_kib`
+       larger than `cores.<id>.memory.heap_kib`; inference may OOM.
+    5. WARNING (not error): `cores.<id>.power.sleep_mode != disabled`
+       with no `wakeup_sources:` declared; device will sleep but can't
+       wake.
+
+    Also enforces the `extra_libraries:` invariants the schema can't
+    cleanly express (P2.1):
+
+      - Exactly one of `kconfig:` / `profile:` per entry.
+      - Names globally unique across every core's `extra_libraries:`.
+      - Names don't collide with the curated `libraries:` enum.
+      - `profile:` paths resolve to a real file (repo-relative).
+
+    The curated set is recomputed against `project.effective_metadata_root()`
+    (NOT the module-level `_CURATED_LIBRARIES`, which stays pinned to the
+    SDK's own in-tree metadata/ for `check_library_registry.py`'s
+    self-consistency gate) so an `--metadata-root` override's own curated
+    libraries collide correctly instead of the SDK's in-tree set (#1485).
+    """
+    curated_libraries = _curated_library_names(
+        project.effective_metadata_root())
+
+    # ---- extra_libraries invariants (P2.1) -----------------------
+    seen_names: dict[str, str] = {}    # name -> first core_id seen on
+    for core_id, slice_ in project.cores.items():
+        for idx, entry in enumerate(slice_.extra_libraries):
+            name = entry.get("name")
+            if not isinstance(name, str) or not name:
+                raise OrchestratorError(
+                    f"core '{core_id}' extra_libraries[{idx}]: missing "
+                    f"or non-string `name:`")
+            has_kc = "kconfig" in entry and entry.get("kconfig") is not None
+            has_pf = "profile" in entry and entry.get("profile") is not None
+            if has_kc == has_pf:
+                # Both set OR both unset -- reject.
+                raise OrchestratorError(
+                    f"core '{core_id}' extra_libraries entry '{name}' "
+                    f"must declare exactly one of `kconfig:` or "
+                    f"`profile:` (got "
+                    f"{'both' if has_kc and has_pf else 'neither'}).  "
+                    f"Inline `kconfig:` is the fast path; `profile:` "
+                    f"points at a hw-backends.yaml-style file.")
+            if name in curated_libraries:
+                raise OrchestratorError(
+                    f"core '{core_id}' extra_libraries entry '{name}' "
+                    f"collides with the curated `libraries:` enum; "
+                    f"declare curated libraries via "
+                    f"`cores.{core_id}.libraries:` instead.")
+            if name in seen_names:
+                raise OrchestratorError(
+                    f"core '{core_id}' extra_libraries entry '{name}' "
+                    f"collides with the same name on core "
+                    f"'{seen_names[name]}'; extra_libraries names "
+                    f"must be globally unique across all cores.")
+            seen_names[name] = core_id
+            if has_pf:
+                prof = entry.get("profile")
+                if not isinstance(prof, str) or not prof:
+                    raise OrchestratorError(
+                        f"core '{core_id}' extra_libraries entry "
+                        f"'{name}' has non-string `profile:`")
+                try:
+                    prof_path = (REPO / prof).resolve()
+                    prof_is_file = prof_path.is_file()
+                except (OSError, RuntimeError) as e:
+                    # A symlink loop (ELOOP) surfaces differently per
+                    # platform: on POSIX, `Path.resolve()` detects the
+                    # cycle itself and raises `RuntimeError` before
+                    # `Path.is_file()` is ever reached; on Windows,
+                    # `.resolve()` returns without raising and it's
+                    # `Path.is_file()` that raises a plain `OSError`
+                    # (`WinError 1920`, "The file cannot be accessed
+                    # by the system") -- confirmed on both platforms
+                    # against a real symlink loop, not a mock. `.is_file()`
+                    # also re-raises `PermissionError` (an `OSError`
+                    # subclass) on EACCES rather than swallowing it
+                    # like ENOENT/ENOTDIR/EBADF/ELOOP -- alp-sdk#1961's
+                    # "same defect class" note. Same treatment as every
+                    # other extra_libraries invariant in this loop: a
+                    # clean OrchestratorError a board.yaml load can
+                    # report, not an unhandled crash out of the loader.
+                    raise OrchestratorError(
+                        f"core '{core_id}' extra_libraries entry "
+                        f"'{name}' `profile: {prof}` could not be "
+                        f"resolved: {e}") from e
+                if not prof_is_file:
+                    raise OrchestratorError(
+                        f"core '{core_id}' extra_libraries entry "
+                        f"'{name}' `profile: {prof}` does not resolve "
+                        f"to a file at {prof_path}")
+
+    # ---- Rule 1: ota.provider requires a compatible slice -------
+    # Provider-driven dispatch (ADR 0009 follow-up resolved):
+    #   mender   -> Yocto (server-mode) OR Zephyr (Mender-MCU-client)
+    #   hawkbit  -> Zephyr (upstream Hawkbit DDI client)
+    #   mcumgr   -> Zephyr (upstream MCUmgr / SMP)
+    ota = project.ota or {}
+    provider = (ota.get("provider") or "").lower() if isinstance(ota, dict) else ""
+    if provider == "mender":
+        has_target = any(s.os in ("yocto", "zephyr")
+                         for s in project.cores.values())
+        if not has_target:
+            raise OrchestratorError(
+                "ota.provider: mender requires at least one "
+                "cores.<id>.os: yocto (server-mode Mender) OR "
+                "cores.<id>.os: zephyr (Mender-MCU-client); none "
+                "found.  See ADR 0009 for the provider-driven "
+                "dispatch.")
+    elif provider == "hawkbit":
+        if not any(s.os == "zephyr" for s in project.cores.values()):
+            raise OrchestratorError(
+                "ota.provider: hawkbit requires at least one "
+                "cores.<id>.os: zephyr (Hawkbit DDI client is in "
+                "Zephyr upstream); none found.")
+    elif provider == "mcumgr":
+        if not any(s.os == "zephyr" for s in project.cores.values()):
+            raise OrchestratorError(
+                "ota.provider: mcumgr requires at least one "
+                "cores.<id>.os: zephyr (MCUmgr is Zephyr's SMP "
+                "transport for OTA); none found.")
+
+    # ---- Rule 2: boot.signing.algorithm supported by SoM family --
+    boot = project.boot or {}
+    sign = (boot.get("signing") or {}) if isinstance(boot, dict) else {}
+    algo = ((sign.get("algorithm") or "").lower()
+            if isinstance(sign, dict) else "")
+    if algo:
+        family = (project.som_preset.get("family") or "")
+        supported = _boot_signing_supported_for_family(family)
+        if supported is not None and algo not in supported:
+            raise OrchestratorError(
+                f"boot.signing.algorithm: {algo} is not supported by "
+                f"SoM family '{family}'; supported algorithms for "
+                f"this family: {sorted(supported)}.  Edit "
+                f"boot.signing.algorithm or pick a SoM family that "
+                f"supports {algo}.")
+
+    # ---- Rule 3: iot.tls: true requires mbedtls/bearssl ----------
+    for core_id, slice_ in project.cores.items():
+        if not (slice_.iot or {}).get("tls"):
+            continue
+        libs = set(_library_layer.scoped_names(project, slice_=slice_))
+        extras = {e.get("name") for e in slice_.extra_libraries
+                  if isinstance(e.get("name"), str)}
+        if not (libs & _TLS_PROVIDERS) and not (extras & _TLS_PROVIDERS):
+            raise OrchestratorError(
+                f"core '{core_id}' has iot.tls: true but neither "
+                f"`libraries:` nor `extra_libraries:` declares a TLS "
+                f"provider (mbedtls or bearssl).  Add one of these "
+                f"to cores.{core_id}.libraries: (curated) or "
+                f"cores.{core_id}.extra_libraries: (open-set).")
+
+    # ---- Rule 4: inference arena > heap is a WARN ----------------
+    for core_id, slice_ in project.cores.items():
+        arena_kib = (slice_.inference or {}).get("default_arena_kib")
+        heap_kib = (slice_.memory or {}).get("heap_kib")
+        if (isinstance(arena_kib, int) and isinstance(heap_kib, int)
+                and arena_kib > heap_kib):
+            print(
+                f"WARN: cores.{core_id}.inference.default_arena_kib="
+                f"{arena_kib} > cores.{core_id}.memory.heap_kib="
+                f"{heap_kib}; inference may OOM",
+                file=sys.stderr,
+            )
+
+    # ---- Rule 5: sleep_mode != disabled with no wakeup_sources --
+    for core_id, slice_ in project.cores.items():
+        pwr = slice_.power or {}
+        sleep_mode = (pwr.get("sleep_mode") or "disabled").lower()
+        wake = pwr.get("wakeup_sources") or []
+        if sleep_mode != "disabled" and not wake:
+            print(
+                f"WARN: cores.{core_id}.power.sleep_mode={sleep_mode} "
+                f"but no wakeup_sources: declared; device will sleep "
+                f"but cannot wake",
+                file=sys.stderr,
+            )
+
+
+def _enforce_os_matches_core_class(slice_: Slice, core_type: str) -> None:
+    """The runtime follows the core class and is not user-selectable
+    (issue #95): a Cortex-A core runs Yocto/Linux, a Cortex-M core runs
+    Zephyr/RTOS.  A board.yaml may only disable a core (`off`) or drop it to
+    no-OS (`baremetal`); selecting the *other* class's OS is rejected.
+    """
+    if slice_.os in _cross_class_os(core_type):
+        raise OrchestratorError(
+            f"core '{slice_.core_id}' ({core_type or 'unclassified'}): its runtime "
+            f"is determined by the core class (Cortex-A -> Yocto/Linux, "
+            f"Cortex-M -> Zephyr/RTOS) and is not selectable. Set os: 'off' to "
+            f"disable it or 'baremetal' for no-OS firmware -- got os: '{slice_.os}'.")
+
+
+def _enforce_baremetal_app_rule(slice_: Slice) -> None:
+    """`os: baremetal`'s own `app:` rule -- split out of
+    `_enforce_loader_rules` to keep that function under the 50-line
+    function-count budget (tan-cli#1103); same single-purpose-sibling shape
+    as `manifest.py`'s `_check_blob_formats`/`_check_schema_version`
+    (tan-cli#1074).
+
+    alp-sdk#1889: a baremetal core with no `app:` of its own still resolves
+    one -- `_resolve_topology_for_core` (loader.py) merges the SoM topology
+    default OVER a project entry that omits `app:`, and every topology
+    default is one of the two stock tokens checked below (`alp-stock-shim`
+    for Cortex-M, `alp-image-edge` for Cortex-A; see every
+    metadata/e1m_modules/<SKU>.yaml `topology:` block). Neither is a
+    bare-metal app, and there is no bare-metal-flavoured stock default
+    anywhere in the tree, so `not slice_.app` alone never caught this -- the
+    inherited token is truthy.
+
+    Before this refusal existed the slice was NOT silently dropped: it
+    reached the executor with a real, wrong-target build command (`cmake -S
+    .../alp-stock-shim -B .` for the Cortex-M case, a nonexistent
+    `alp-image-edge` source dir for the Cortex-A one) that failed
+    downstream with a confusing, off-target CMake error instead of this
+    explicit one."""
+    if slice_.app in (STOCK_SHIM_APP, STOCK_IMAGE_APP):
+        other_os = "zephyr" if slice_.app == STOCK_SHIM_APP else "yocto"
+        raise OrchestratorError(
+            f"core '{slice_.core_id}': os: baremetal requires `app:` "
+            f"pointing at a CMakeLists.txt directory -- `{slice_.app}` is "
+            f"the {other_os} stock default (whether inherited from the SoM "
+            f"topology preset when no `app:` was given, or set explicitly), "
+            f"and there is no bare-metal stock default to fall back to")
+    if not slice_.app:
+        raise OrchestratorError(
+            f"core '{slice_.core_id}': os: baremetal requires `app:` "
+            f"pointing at a CMakeLists.txt directory")
+
+
+def _enforce_loader_rules(slice_: Slice, metadata_root: Path) -> None:
+    """Loader rules from spec §4.5: every non-off slice must declare
+    enough to actually build."""
+    if slice_.os == "off":
+        return
+    if slice_.os == "zephyr":
+        if not slice_.app:
+            raise OrchestratorError(
+                f"core '{slice_.core_id}': os: zephyr requires `app:` "
+                f"pointing at a prj.conf / CMakeLists.txt directory")
+    elif slice_.os == "baremetal":
+        _enforce_baremetal_app_rule(slice_)
+    elif slice_.os == "yocto":
+        if not slice_.app and not slice_.image:
+            raise OrchestratorError(
+                f"core '{slice_.core_id}': os: yocto requires either "
+                f"`app:` (custom recipe) or `image:` (stock recipe)")
+    elif slice_.os not in _core_os_choices(metadata_root):
+        raise OrchestratorError(
+            f"core '{slice_.core_id}': unknown os '{slice_.os}'")

tan/planner/whole_device_alias.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Shared "extent == aperture exactly" whole-device-alias predicate (alp-sdk#2073).
+
+A `memory_map:` region whose resolved `[base, base + size)` extent equals
+a SoC's declared on-die MRAM aperture exactly (e.g. `mram_main`, once its
+`base` stops being the `"TBD"` sentinel) is the device itself, not a
+partition inside it -- `atoc`/`mcuboot`/`he_slot0`/`hp_slot0`/`reserved`/
+`storage` all subdivide the SAME window `mram_main` aliases.
+
+Two independent callers need this exact predicate and must never drift on
+it: `aperture.py`'s `classify_region()` / `is_partition_inside_aperture()`
+(the aperture-tiling / flash-class checks, alp-sdk#1365 split B), and
+`zephyr_board.py`'s `_aen_check_map_overlaps()` (the disjoint-slot0
+overlap check, alp-sdk#2073).
+
+RELOCATION NOTE -- this module keeps its own file for a DIFFERENT reason
+than upstream's. Upstream `scripts/whole_device_alias.py` is flat and
+package-free because `gen_zephyr_board.py` lives OUTSIDE the
+`alp_orchestrate` package, so importing the predicate from
+`alp_orchestrate.aperture` would drag in the whole orchestrator
+(jsonschema, alp_project, alp_cli) and add a package-to-generator import
+loop with `loader.py` / `secure.py`'s existing deferred import going the
+other way. NEITHER hazard exists here: `aperture.py` and `zephyr_board.py`
+are both inside `tan.planner`, so a plain `from .whole_device_alias import
+...` costs nothing and closes no loop. What DOES carry over is the reason
+the predicate is shared at all -- one spelling, so the callers cannot
+drift, which is the entire point of alp-sdk#2073.
+
+That is also why this is NOT inlined the way `sentinels.is_tbd` was
+relocated into `zephyr_board.py::_is_tbd`. That inline stays within ONE
+module (six call sites, all inside `zephyr_board.py`); this predicate is
+needed by TWO, so inlining it would mean two copies in two files.
+And `is_tbd` is the warning here, not the model: tan already carries a
+SECOND, independent copy of that same predicate at `slugs.py:108`
+(imported by `kconfig.py`), so the relocated spelling did not stay single
+even inside tan. Keeping exactly one spelling of THIS predicate is the
+whole point of alp-sdk#2073.
+
+Upstream's docstring also records that `check_atoc_reservation.py` still
+hand-writes this same comparison instead of importing it. That gap is
+alp-sdk's alone -- tan relocates no counterpart of that gate, so the
+three call sites named above (`aperture.py`'s two, `zephyr_board.py`'s
+one) are the whole surface here.
+"""
+
+from __future__ import annotations
+
+
+def is_whole_device_alias(
+    ext: tuple[int, int], aperture: tuple[int, int],
+) -> bool:
+    """True when *ext* equals *aperture* exactly -- the whole-device alias
+    case, not a partition inside the device.
+
+    `classify_region()` and `is_partition_inside_aperture()` both test
+    this FIRST, before their subset-containment check, because the
+    alias's own extent also satisfies `lo >= full_lo and hi <= full_hi`
+    -- order matters, not just the predicate. Comparing BOTH edges is
+    the whole point: a region merely flush with the aperture's low edge
+    (e.g. `mcuboot`, same `base` as `mram_main`, far smaller `size_kib`)
+    must NOT match here, or a genuine overlap at that edge would be
+    silently excluded from the overlap comparison instead of refused.
+    """
+    lo, hi = ext
+    full_lo, full_hi = aperture
+    return lo == full_lo and hi == full_hi