tan-cli 0.7.0__py3-none-any.whl

tan/templates/vendored/edge-ai/E1M-V2N101/src/main.c

@@ -0,0 +1,373 @@
+/*
+ * Copyright 2026 Alp Lab AB
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * cold-chain-monitor
+ * ==================
+ *
+ * Pharma/food cold-chain integrity monitor.  Pipeline:
+ *
+ *   BME280 (I2C) --read_raw + compensate--> T(C) / RH(%) / P(Pa)
+ *     --sliding window--> cold_chain (mean/min/max, MKT, dewpoint, excursion)
+ *       -> cc_classify (OK / TEMP_EXCURSION / MKT_EXCEEDED / CONDENSATION_RISK)
+ *       + <alp/inference.h> anomaly score (deterministic fallback)
+ *     --> one CC record per report window.
+ *
+ * Honest scope: a reference cold-chain logger.  MKT, dewpoint, and excursion
+ * time are the real metrics; thresholds are configurable per product.  This is
+ * NOT a certified GxP / 21-CFR-Part-11 data logger (no validated audit trail,
+ * no calibration traceability, no tamper-proof storage).  The model is a stub
+ * (see https://github.com/alplabai/alp-sdk/blob/v0.17.0/examples/ai/cold-chain-monitor/models/README.md); with no model the
+ * deterministic classifier + anomaly fallback run.
+ *
+ *
+ * ── Why the BME280 ────────────────────────────────────────────────────────
+ *
+ * The Bosch BME280 is a combined temperature / humidity / barometric pressure
+ * sensor well suited to cold-chain loggers:
+ *   - Temperature range -40..+85 C, accuracy ±1.0 C RMS, sufficient for
+ *     the ±0.5 C inter-unit spread allowed by GxP-adjacent monitoring.
+ *   - Humidity ±3% RH at 25 C enables dewpoint estimation (condensation /
+ *     mould risk on packaging and metal surfaces).
+ *   - Pressure is logged but not classified by this demo; it's useful for
+ *     altitude compensation and for detecting seal-break events in insulated
+ *     shippers where a damaged seal opens to ambient.
+ *   - I2C single-chip integration keeps the BOM to a minimum; SPI arrives
+ *     in the v0.3 driver.
+ *   - Normal-mode continuous sampling at a user-selected standby interval
+ *     eliminates the MCU-driven trigger polling needed in Forced mode.
+ *
+ *
+ * ── Measurement cadence and window sizing ─────────────────────────────────
+ *
+ * CC_WINDOW_N (256 samples) * CC_SAMPLE_MIN (1.0 min/sample) = 256 minutes
+ * = ~4.3 hours per report window.  That matches a common GDP-compliant
+ * logging interval (log every 5..15 min over a 24 h transit) while keeping
+ * the window SRAM footprint under 4 kB (256 × 12 B = 3072 B).
+ *
+ * In this demo the "1 minute" cadence is simulated: all 256 synthetic samples
+ * are pushed immediately so the pipeline exercises the framing path without
+ * sleeping.  On real hardware a k_timer drives one bme280_read_raw() call per
+ * real minute (or whatever the product's logging period is).
+ *
+ *
+ * ── Cold-chain standards ──────────────────────────────────────────────────
+ *
+ * MKT (Mean Kinetic Temperature, ICH Q1A / USP <1079>):
+ *   The single equivalent temperature that delivers the same cumulative
+ *   Arrhenius thermal stress as the fluctuating temperature profile.
+ *   A brief hot excursion contributes more than an equal-duration cool dip,
+ *   so MKT >= arithmetic mean.  The regulatory limit for most vaccines is
+ *   MKT <= 8 C (the same as the storage upper bound), so a distribution that
+ *   averaged 6 C but had a 12 C spike for 30 min would still breach.
+ *   ΔH/R = 10 000 K is the ICH default (ΔH = 83.144 kJ/mol for pharma).
+ *
+ * Dewpoint (Magnus formula):
+ *   When ambient temperature approaches the dewpoint, water condenses on
+ *   cold surfaces -- packaging labels detach, metal contacts corrode,
+ *   biological samples degrade.  The dewpoint_margin_c config knob controls
+ *   how close the reading must be to the dewpoint before CONDENSATION_RISK
+ *   is raised.
+ *
+ *
+ * ── Classifier priority ordering ──────────────────────────────────────────
+ *
+ * The 4-state classifier (implemented in cold_chain.c) reports the HIGHEST
+ * severity condition present:
+ *   CC_TEMP_EXCURSION    -- product is currently out of the safe band, or
+ *                           the cumulative out-of-band time exceeds the limit.
+ *                           ACUTE: operator must act immediately.
+ *   CC_MKT_EXCEEDED      -- the equivalent thermal stress has crossed the
+ *                           regulatory limit even if the product is currently
+ *                           in-band.  CUMULATIVE: product may be degraded.
+ *   CC_CONDENSATION_RISK -- high humidity or temperature near the dewpoint;
+ *                           packaging and surface integrity may be compromised.
+ *   CC_OK                -- all metrics within limits.
+ *
+ *
+ * ── AI anomaly score ──────────────────────────────────────────────────────
+ *
+ * The threshold-based classifier catches known bad states.  The AI score
+ * catches SUBTLE DRIFT that no single threshold catches: a slowly degrading
+ * compressor that nudges the mean temperature up by 0.3 C per week, or a
+ * door-seal micro-leak that correlates the humidity rise with the warming
+ * slope.  The fallback (cc_anomaly_fallback) implements the same idea
+ * deterministically: it returns max(excursion depth, MKT overshoot),
+ * saturating at 1.0.  A trained autoencoder running via <alp/inference.h>
+ * replaces this with a learned reconstruction error.
+ *
+ *
+ * ── native_sim / no-sensor fallback ──────────────────────────────────────
+ *
+ * On native_sim the I2C emul controller answers open() / ioctl() but has no
+ * BME280 target attached, so bme280_init() fails the CHIP_ID check.  main()
+ * detects this and fills every window with synthetic environment data via
+ * synth_sample(), covering the three interesting states:
+ *   window 0: stable in-band cold  -> CC_OK
+ *   window 1: warming ramp         -> CC_TEMP_EXCURSION
+ *   window 2: near-saturated air   -> CC_CONDENSATION_RISK
+ * On real silicon fill the window from bme280_read_raw() instead.
+ */
+#include <string.h>
+#include <zephyr/kernel.h>
+#include <zephyr/logging/log.h>
+
+/* Board-portable alias for the sensor I2C bus: BOARD_I2C_SENSORS resolves to
+ * the correct on-board I2C controller for whatever EVK is targeted via the
+ * CONFIG_COMPILER_OPT="-DALP_BOARD_E1M_EVK" build flag. */
+#include "alp/board.h"
+/* AI inference dispatch: AUTO routes to Ethos-U55 on AEN, DEEPX DX-M1 on V2N,
+ * and the reference TFLM CPU kernels on native_sim. */
+#include "alp/inference.h"
+/* Portable I2C open/close/read/write primitives (no vendor names). */
+#include "alp/peripheral.h"
+/* BME280 combined T/RH/P chip driver (I2C v0.2, paper-correct). */
+#include "alp/chips/bme280.h"
+
+/* Pure-C cold-chain metrics, classifier, and anomaly fallback (arch-neutral,
+ * no Zephyr deps -- identical source compiles for native_sim and the M55). */
+#include "cold_chain.h"
+
+LOG_MODULE_REGISTER(cc, LOG_LEVEL_INF);
+
+/* BME280 I2C address: SDO-tied-low = 0x76 on the EVK (0x77 if SDO is high).
+ * Override at compile time if your carrier boards SDO differently. */
+#define BME280_ADDR 0x76u
+/* Number of report windows in the bounded demo run (3 covers OK / EXCURSION /
+ * CONDENSATION in the synthetic scenario; a real logger runs indefinitely). */
+#define N_REPORTS 3
+
+/* Vaccine-fridge thresholds (2..8 C, USP <1079> Annex 1 cold chain).
+ * A real deployment loads the limits for the specific product (frozen at
+ * -20 C, ambient-stable at +25 C, etc.) from NVS or a compile-time overlay. */
+static const struct cc_config CFG = {
+	.t_lo                = 2.0f,  /* safe-band lower edge, Celsius */
+	.t_hi                = 8.0f,  /* safe-band upper edge, Celsius */
+	.mkt_limit_c         = 8.0f,  /* MKT above this -> cumulative damage */
+	.excursion_min_limit = 30.0f, /* out-of-band minutes before EXCURSION */
+	.dewpoint_margin_c   = 2.0f,  /* T within this of dewpoint -> CONDENSATION */
+};
+
+/* 1-byte stub so alp_inference_open's non-NULL model-data contract is met.
+ * An unusable tensor (wrong shape from the stub backend) causes every
+ * alp_inference_invoke() to return no usable output, which anomaly_score()
+ * detects and routes to cc_anomaly_fallback().  See
+ * https://github.com/alplabai/alp-sdk/blob/v0.17.0/examples/ai/cold-chain-monitor/models/README.md for the autoencoder
+ * training recipe to replace this stub. */
+static const uint8_t s_model[] = { 0x00 };
+
+/*
+ * synth_sample() -- synthetic environment data for native_sim / no sensor.
+ *
+ * Generates a deterministic (T, RH, P) triple for sample @p i of report
+ * window @p report.  Three scenarios are exercised across the N_REPORTS
+ * windows so the classifier produces a meaningful state spread:
+ *
+ *   report 0: steady in-band cold storage (5 C, 50 % RH)        -> CC_OK
+ *   report 1: warming ramp (5..12 C linear)                      -> CC_TEMP_EXCURSION
+ *   report 2: cold but near-saturated air (5 C, 95 % RH)        -> CC_CONDENSATION_RISK
+ *
+ * Pressure is fixed at 101325 Pa (sea-level standard) for all windows;
+ * it does not affect classification in this demo.
+ */
+static struct cc_sample synth_sample(int report, int i)
+{
+	/* Baseline: stable cold storage in the 2..8 C vaccine fridge band. */
+	struct cc_sample s = { .temp_c = 5.0f, .rh_pct = 50.0f, .pressure_pa = 101325.0f };
+	switch (report) {
+	case 0:
+		break; /* stable cold -- all defaults are fine */
+	case 1:
+		/* Linear warming ramp from 5 C to 12 C across the window.
+		 * This drives the mean above t_hi and the excursion counter
+		 * past the limit, triggering CC_TEMP_EXCURSION. */
+		s.temp_c = 5.0f + 7.0f * (float)i / (float)(CC_WINDOW_N - 1);
+		s.rh_pct = 55.0f;
+		break;
+	default:
+		/* Near-saturated cold air: temperature stays in-band but RH
+		 * is high enough that the Magnus dewpoint is within
+		 * dewpoint_margin_c of the ambient temperature, raising
+		 * CC_CONDENSATION_RISK. */
+		s.rh_pct = 95.0f;
+		break;
+	}
+	return s;
+}
+
+/*
+ * anomaly_score() -- AI model if available, else the deterministic fallback.
+ *
+ * Packs the cc_features vector, invokes the loaded model, and reads the
+ * first float output as a 0..1 anomaly score.  Falls back to
+ * cc_anomaly_fallback() when:
+ *   - @p inf is NULL (inference handle failed to open),
+ *   - the stub model returns an empty / wrongly-typed output tensor, or
+ *   - alp_inference_invoke() returns a non-OK status.
+ * This "try model, fall back cleanly" pattern matches the sibling examples
+ * and means the demo always produces a meaningful score offline.
+ */
+static float anomaly_score(alp_inference_t *inf, const struct cc_features *f)
+{
+	if (inf != NULL) {
+		/* Pack the 8 metrics into the flat float vector the model expects. */
+		float vec[CC_FEATURE_DIM];
+		(void)cc_feat_pack(f, vec, CC_FEATURE_DIM);
+		alp_inference_tensor_t in = { 0 };
+		/* Copy into the model's input tensor only if the shape matches. */
+		if (alp_inference_get_input(inf, 0, &in) == ALP_OK && in.dtype == ALP_INFERENCE_DTYPE_F32 &&
+		    in.data != NULL && in.size_bytes >= sizeof(vec)) {
+			memcpy(in.data, vec, sizeof(vec));
+			if (alp_inference_invoke(inf) == ALP_OK) {
+				alp_inference_tensor_t out = { 0 };
+				/* Read the scalar anomaly score from the output tensor. */
+				if (alp_inference_get_output(inf, 0, &out) == ALP_OK &&
+				    out.dtype == ALP_INFERENCE_DTYPE_F32 && out.data != NULL &&
+				    out.size_bytes >= sizeof(float)) {
+					return ((const float *)out.data)[0];
+				}
+			}
+		}
+	}
+	/* Deterministic fallback: max(excursion depth, MKT overshoot), clamped
+	 * to 1.0.  Transparent, always correct, gives the demo a meaningful
+	 * score without any trained model. */
+	return cc_anomaly_fallback(f, &CFG);
+}
+
+int main(void)
+{
+	/* Driver context and window state are static so they do not consume
+	 * stack on the Zephyr M55 thread (the BME280 calib struct is 26 bytes;
+	 * the window is 256 × 12 B = 3072 B). */
+	static bme280_t               dev;
+	static struct cc_window_state win;
+	bool                          sensor_ok = false;
+
+	/* ── Sensor bring-up ─────────────────────────────────────────────────
+	 * Open the shared sensor I2C bus (BOARD_I2C_SENSORS resolves to the
+	 * correct on-board controller for the target EVK) and initialise the
+	 * BME280.  bme280_init() reads CHIP_ID and loads the per-die calibration
+	 * coefficients; it returns ALP_ERR_IO if no BME280 responds.
+	 * On native_sim the emul controller has no target attached, so init
+	 * fails cleanly and we fall back to synth_sample(). */
+	alp_i2c_t *bus =
+	    alp_i2c_open(&(alp_i2c_config_t){ .bus_id = BOARD_I2C_SENSORS, .bitrate_hz = 400000 });
+	if (bus != NULL && bme280_init(&dev, bus, BME280_ADDR) == ALP_OK) {
+		/* bme280_init() leaves the oversampling / mode registers untouched.
+		 * Configure continuous-conversion (NORMAL) mode with X1 oversampling
+		 * on all three channels (T, P, H), a 1 s standby period between
+		 * measurements, and no IIR filter.  bme280_read_raw() will then
+		 * return a fresh reading without needing to poll the status register.
+		 * For a cold-chain logger the 1 s cadence is already faster than the
+		 * CC_SAMPLE_MIN (1 min) window rate, so X1/1 s is well matched. */
+		(void)bme280_set_sampling(&dev,
+		                          BME280_OVERSAMPLING_X1, /* temperature channel */
+		                          BME280_OVERSAMPLING_X1, /* pressure channel */
+		                          BME280_OVERSAMPLING_X1, /* humidity channel */
+		                          BME280_MODE_NORMAL,     /* continuous conversion */
+		                          BME280_STANDBY_1000_MS, /* 1 s between measurements */
+		                          BME280_FILTER_OFF);     /* no IIR smoothing */
+		sensor_ok = true;
+	} else {
+		LOG_WRN("BME280 unavailable; using synthetic environment data");
+	}
+
+	/* ── Inference bring-up ──────────────────────────────────────────────
+	 * Open the inference handle.  BACKEND_AUTO selects Ethos-U on AEN,
+	 * DEEPX DX-M1 on V2N, or the TFLM CPU kernels on native_sim.
+	 * The 1-byte stub model causes every invoke() to return an unusable
+	 * output, so anomaly_score() falls back to the deterministic path. */
+	alp_inference_t *inf = alp_inference_open(&(alp_inference_config_t){
+	    .backend    = ALP_INFERENCE_BACKEND_AUTO,
+	    .format     = ALP_INFERENCE_MODEL_TFLITE,
+	    .model_data = s_model,
+	    .model_size = sizeof(s_model),
+	});
+
+	/* CSV header: one line per report window.  Field order matches the
+	 * documented output schema and the README example. */
+	printk("# CC,t_s,state,temp_c,rh_pct,dewpoint_c,mkt_c,excursion_min\n");
+
+	/* ── Report loop ─────────────────────────────────────────────────────
+	 * Each iteration resets the window, fills it (real or synthetic), then
+	 * reduces it to metrics and emits one CC record.  N_REPORTS = 3 covers
+	 * the OK / EXCURSION / CONDENSATION states in the synthetic scenario. */
+	for (int r = 0; r < N_REPORTS; r++) {
+		/* Reset the window for this report period. */
+		cc_window_reset(&win);
+
+		/* Fill one window of readings (real sensor or synthetic). */
+		for (int i = 0; i < CC_WINDOW_N; i++) {
+			struct cc_sample s;
+			if (sensor_ok) {
+				/* Real sensor path: burst-read the raw 20/20/16-bit
+				 * conversion result, then compensate with the per-die
+				 * calibration loaded at init.  The BME280 is running
+				 * continuously (NORMAL mode), so the result is fresh
+				 * within the 1 s standby period. */
+				bme280_raw_t         raw;
+				bme280_compensated_t c;
+				if (bme280_read_raw(&dev, &raw) == ALP_OK &&
+				    bme280_compensate(&dev, &raw, &c) == ALP_OK) {
+					/* Convert from fixed-point to float physical units:
+					 *   temperature_c100 is degrees × 100 -> C
+					 *   humidity_milli_pct is %RH × 1024 -> %
+					 *   pressure_pa is already pascals. */
+					s.temp_c      = (float)c.temperature_c100 / 100.0f;
+					s.rh_pct      = (float)c.humidity_milli_pct / 1024.0f;
+					s.pressure_pa = (float)c.pressure_pa;
+				} else {
+					/* I/O error mid-window: fall back to synth for
+					 * this sample so the window stays complete. */
+					s = synth_sample(r, i);
+				}
+			} else {
+				/* No sensor: generate deterministic synthetic data. */
+				s = synth_sample(r, i);
+			}
+			cc_window_push(&win, s);
+		}
+
+		/* Reduce the window to metrics, classify, score the anomaly, emit. */
+		struct cc_features f;
+		cc_feat_extract(&win, &CFG, &f);
+		cc_state_t st = cc_classify(&f, &CFG);
+		/* Compute the anomaly score (model or deterministic fallback).
+		 * In a real gateway deployment `an` is forwarded via MQTT / OPC-UA
+		 * alongside the classifier state; here we suppress the unused-var
+		 * warning with (void) since this demo only emits the state string. */
+		float an = anomaly_score(inf, &f);
+		(void)an;
+
+		/* Emit one CSV record.  t_s = elapsed monitoring time in minutes
+		 * = samples-completed × CC_SAMPLE_MIN (1.0 min/sample). */
+		printk("CC,%.1f,%s,%.1f,%.1f,%.1f,%.1f,%.1f\n",
+		       (double)((r + 1) * CC_WINDOW_N * CC_SAMPLE_MIN),
+		       cc_state_name(st),
+		       (double)f.mean_temp_c,
+		       (double)f.mean_rh_pct,
+		       (double)f.dewpoint_c,
+		       (double)f.mkt_c,
+		       (double)f.excursion_min);
+	}
+
+	/* ── Lifecycle teardown ──────────────────────────────────────────────
+	 * Release in reverse acquisition order: model, sensor, bus.
+	 * bme280_soft_reset() writes 0xB6 to the RESET register so the chip
+	 * returns to its power-on state; the bus is then safe to release. */
+	if (inf != NULL) {
+		alp_inference_close(inf);
+	}
+	if (sensor_ok) {
+		/* Soft-reset the chip before releasing the bus so it stops
+		 * converting and returns to sleep (lowest power state). */
+		bme280_soft_reset(&dev);
+		bme280_deinit(&dev); /* Release the driver context (no chip power-down). */
+	}
+	if (bus != NULL) {
+		alp_i2c_close(bus);
+	}
+	printk("[cc] done\n");
+	return 0;
+}

tan/templates/vendored/edge-ai/E1M-V2N101/testcase.yaml

@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: Apache-2.0
+
+sample:
+  name: cold-chain-monitor
+  description: |
+    Cold-chain integrity monitor: BME280 T/RH/P -> sliding-window metrics
+    (MKT / dewpoint / excursion time) -> 4-state classifier (OK / TEMP_EXCURSION
+    / MKT_EXCEEDED / CONDENSATION_RISK) + AI anomaly score (deterministic
+    fallback).  native_sim runs synthetic environment data covering the states.
+common:
+  tags: ai inference industrial environmental cold-chain marketing showcase
+tests:
+  alp_sdk.example.cold_chain_monitor.e1m_evk:
+    extra_args: EXTRA_CONF_FILE=generated/alp.conf
+    extra_configs:
+      - 'CONFIG_COMPILER_OPT="-DALP_BOARD_E1M_EVK"'
+    platform_allow:
+      - native_sim/native/64
+    integration_platforms:
+      - native_sim/native/64
+    tags:
+      - alp-sdk
+      - example
+      - ai
+      - environmental
+    harness: console
+    harness_config:
+      type: one_line
+      regex:
+        - "\\[cc\\] done"
+
+  alp_sdk.example.cold_chain_monitor.e1m_x_evk:
+    extra_args: EXTRA_CONF_FILE=generated/alp.conf
+    extra_configs:
+      - 'CONFIG_COMPILER_OPT="-DALP_BOARD_E1M_X_EVK"'
+    platform_allow:
+      - native_sim/native/64
+    integration_platforms:
+      - native_sim/native/64
+    tags:
+      - alp-sdk
+      - example
+      - ai
+      - environmental
+    harness: console
+    harness_config:
+      type: one_line
+      regex:
+        - "\\[cc\\] done"
+
+  alp_sdk.example.cold_chain_monitor.aen_build:
+    extra_args: EXTRA_CONF_FILE=generated/alp.conf
+    extra_configs:
+      - 'CONFIG_COMPILER_OPT="-DALP_BOARD_E1M_EVK"'
+    platform_allow:
+      - alp_e1m_aen801_m55_hp/ae822fa0e5597ls0/rtss_hp
+    build_only: true
+    tags:
+      - alp-sdk
+      - example
+      - ai
+      - environmental

tan/templates/vendored/iot/E1M-AEN801/CMakeLists.txt

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.20)
+
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(mqtt_telemetry LANGUAGES C)
+
+target_sources(app PRIVATE src/main.c)
+# Reusable SoM bring-up helper (cc3501e_bridge_bringup): the one-call CC3501E
+# bridge init this app uses so alp_wifi_open() can bind to a ready bridge on
+# E1M-AEN801 (#2112). Copyable template, same file as examples/aen/aen-cc3501e-*
+# -- see src/cc3501e_bridge.h. Built unconditionally; alp_gpio_open()/alp_spi_open()
+# fail fast (NULL, no matching backend) on native_sim, so this is a no-op there.
+target_sources(app PRIVATE src/cc3501e_bridge.c)

tan/templates/vendored/iot/E1M-AEN801/README.md

@@ -0,0 +1,103 @@
+# mqtt-telemetry
+
+The **connected device** starting point: bring up Wi-Fi, open an
+`mqtts://` (TLS) MQTT client, and publish a telemetry reading on a
+cadence -- the whole path on the portable [`<alp/iot.h>`](https://github.com/alplabai/alp-sdk/blob/v0.17.0/include/alp/iot.h)
+surface.
+
+```
+alp_wifi_open() -> alp_wifi_connect()          # Wi-Fi station up
+alp_mqtt_open(mqtts://... , CA pinned)          # TLS MQTT client
+alp_mqtt_connect() -> alp_mqtt_publish() x N    # publish telemetry
+alp_mqtt_close()                                # clean disconnect
+```
+
+## Supported hardware -- AEN only
+
+This template ships for **E1M-AEN801 only**. Its transport is the
+**CC3501E Wi-Fi6+BLE coprocessor bridge**
+([`docs/cc3501e-bridge.md`](https://github.com/alplabai/alp-sdk/blob/v0.17.0/docs/cc3501e-bridge.md)),
+silicon-validated 2026-06-24. The app never names the bridge -- the
+AEN board emit wires it as the `<alp/iot.h>` Wi-Fi backend from
+`iot.wifi: true` in `board.yaml`.
+
+The **E1M-V2N101 is deliberately not supported**: its Murata Wi-Fi
+(`murata_lbee5hy2fy`) is `hil_silicon: untested` and its Linux-side
+data path is an unmerged design, so there is no working Wi-Fi
+transport for that family yet. Do not add it to a scaffold of this
+template until that port lands.
+
+## TLS status -- preview
+
+The `mqtts://` path is configured through the portable API (broker URI + a
+pinned CA) and **mbedTLS is now built in on every target**, native_sim
+included. It used to be held off: with mbedTLS' PSA core disabled the pinned
+library's own `ssl_misc.h` does not compile (`unknown type name
+'mbedtls_error_pair_t'`), so the app turned mbedTLS off rather than fail. The
+SDK now turns that PSA core on wherever it builds mbedTLS without TF-M
+(`ALP_SDK_MBEDTLS_PSA_CRYPTO`, issue #2173), so this app carries no mbedTLS
+knobs at all any more (see [`prj.conf`](https://github.com/alplabai/alp-sdk/blob/v0.17.0/examples/connectivity/mqtt-telemetry/prj.conf), which is
+empty by design) and the `native_sim.conf` that used to hold the workaround is
+deleted.
+
+AEN hardware builds seed the PSA core from the Secure Enclave TRNG entropy
+driver (`alif,se-trng`, bench-proven on both M55 cores, issue #2192), which
+every AEN board chooses as `zephyr,entropy` by default, so the AEN Twister
+scenario needs no weak-RNG opt-in. Only the native_sim scenario, which has no
+real entropy source, still sets `CONFIG_ALP_SDK_ALLOW_TEST_ENTROPY=y`.
+
+## The "sensor reading"
+
+To keep the focus on the transport, this template publishes a
+**synthetic metric** (device uptime). Swap
+`read_telemetry_value()` for a real sensor read -- e.g. compose it
+with the [`sensor` template](https://github.com/alplabai/alp-sdk/tree/v0.17.0/examples/peripheral-io/i2c-master) (BMP581
+over `<alp/chips/bmp581.h>`) -- and the publish path is unchanged.
+
+## Build
+
+```bash
+# Standalone, native_sim (no radio, so the app prints the framing it
+# would publish; mbedTLS is built in):
+# writes ./generated/alp.conf, which west reads below (#866)
+tan generate --target zephyr-conf --core m55_hp --sdk-root "$ALP_SDK_ROOT" --output generated/alp.conf
+west build -b native_sim/native/64 . \
+    -- -DEXTRA_CONF_FILE=generated/alp.conf -DEXTRA_ZEPHYR_MODULES=$ALP_SDK_ROOT
+west build -t run
+
+# On real silicon (E1M-AEN801):
+west build -b alp_e1m_aen801_m55_hp/ae822fa0e5597ls0/rtss_hp . -- -DEXTRA_CONF_FILE=generated/alp.conf
+west flash
+```
+
+## Expected output
+
+native_sim (no Wi-Fi/MQTT backend; framing only):
+
+```
+[mqtt] alp-sdk mqtt-telemetry demo (publish over MQTT/TLS)
+[mqtt] transport: CC3501E Wi-Fi bridge (E1M-AEN801)
+[mqtt] wifi: opening station
+[mqtt] wifi: alp_wifi_open -> NULL (ALP_ERR_NOT_READY)
+[mqtt] no transport on this build -- printing framing only
+[mqtt] would publish to alp/telemetry/e1m-aen801: {"device":"e1m-aen801-demo","metric":"uptime_s","value":0}
+[mqtt] would publish to alp/telemetry/e1m-aen801: {"device":"e1m-aen801-demo","metric":"uptime_s","value":5}
+[mqtt] would publish to alp/telemetry/e1m-aen801: {"device":"e1m-aen801-demo","metric":"uptime_s","value":10}
+[mqtt] done
+```
+
+Real hardware (E1M-AEN801, associated + broker reachable):
+
+```
+[mqtt] wifi: associated to "alp-demo-ap"
+[mqtt] broker: connected
+[mqtt] publish 0 -> ALP_OK: {"device":"e1m-aen801-demo","metric":"uptime_s","value":0}
+...
+[mqtt] done
+```
+
+## Reference
+
+- [`<alp/iot.h>`](https://github.com/alplabai/alp-sdk/blob/v0.17.0/include/alp/iot.h) -- Wi-Fi station + MQTT client surface.
+- [`docs/cc3501e-bridge.md`](https://github.com/alplabai/alp-sdk/blob/v0.17.0/docs/cc3501e-bridge.md) -- the AEN Wi-Fi transport.
+- [`examples/peripheral-io/i2c-master/`](https://github.com/alplabai/alp-sdk/tree/v0.17.0/examples/peripheral-io/i2c-master) -- the `sensor` template, for a real reading to publish.

tan/templates/vendored/iot/E1M-AEN801/board.yaml

@@ -0,0 +1,69 @@
+# board.yaml -- per-app project configuration for the
+# mqtt-telemetry example (publish a sensor reading over MQTT/TLS).
+#
+# The "connected device" starting point: bring up the Wi-Fi
+# station, open an `mqtts://` (TLS) MQTT client via the portable
+# <alp/iot.h> surface, and publish a telemetry reading on a
+# cadence.  All app code stays on <alp/iot.h> -- the transport
+# underneath is the CC3501E Wi-Fi6+BLE coprocessor bridge on the
+# E1M-AEN801 (see https://github.com/alplabai/alp-sdk/blob/v0.17.0/docs/cc3501e-bridge.md), selected automatically
+# by the AEN board emit; no app change is needed to target it.
+#
+# AEN-only by design: the E1M-V2N101's Murata Wi-Fi
+# (murata_lbee5hy2fy) is `hil_silicon: untested` and its Linux-side
+# data path is an unmerged design, so there is no working Wi-Fi
+# transport for that family yet.  Shipping this template for the one
+# family whose transport is silicon-proven (AEN, validated
+# 2026-06-24) is deliberate -- see the catalog record's `preview`
+# note.  Do not add E1M-V2N101 to a scaffold of this template until
+# that port lands.
+#
+# Customer workflow: `tan init --from-example connectivity/mqtt-telemetry`,
+# set your SSID/PSK + broker URI in src/main.c (or wire them from
+# provisioning), and `tan build` for the AEN board target.
+libraries:
+  # mbedtls backs the `mqtts://` TLS path.  The v0.6 board.yaml
+  # cross-field validator requires `mbedtls` (or `bearssl`) in
+  # `libraries:` whenever any core sets `iot.tls: true`.
+  - name: mbedtls
+    cores: [m55_hp]
+
+som:
+  sku: E1M-AEN801           # Alif Ensemble E8 + on-module CC3501E
+                            # Wi-Fi6+BLE bridge (the transport).
+
+preset: e1m-evk
+
+cores:
+  m55_hp:
+    app: ./src
+    # IoT toggles.  wifi:true wires the CC3501E bridge as the
+    # <alp/iot.h> Wi-Fi backend on this AEN board; tls:true selects
+    # the mqtts:// (TLS) MQTT path.  CONFIG_MBEDTLS is no longer held
+    # off: the ssl_misc.h break that forced that is fixed at its root
+    # (ALP_SDK_MBEDTLS_PSA_CRYPTO, #2173), so every target builds the
+    # TLS-enabled configuration.  The remaining limit is the RNG, not
+    # the library -- see the README's TLS status section and #2192.
+    iot:
+      wifi: true
+      tls:  true
+    # Portable peripheral subsystems this app opens to bring the CC3501E
+    # bridge up (cc3501e_bridge_bringup(), #2112): SPI1 (inter-chip link)
+    # + the WIFI_EN/nRESET LP-GPIO control pins. Same as the
+    # https://github.com/alplabai/alp-sdk/tree/v0.17.0/examples/aen/aen-cc3501e-* board.yaml. The loader translates these
+    # to CONFIG_SPI=y / CONFIG_GPIO=y in alp.conf.
+    peripherals:
+      - spi
+      - gpio
+
+# The bridge helper this app now carries (src/cc3501e_bridge.h, #2112)
+# includes <alp/chips/cc3501e.h> directly, so the chip has to be declared
+# here for check_example_portability.py's family-compatibility check and
+# the portability ring to account for it -- same as
+# https://github.com/alplabai/alp-sdk/blob/v0.17.0/examples/aen/aen-cc3501e-bringup/board.yaml.  Wi-Fi itself still reaches
+# the app through the portable <alp/iot.h> surface, not this entry.
+chips:
+  - cc3501e
+
+diagnostics:
+  log_level: info

tan/templates/vendored/iot/E1M-AEN801/prj.conf

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: Apache-2.0
+#
+# Empty-by-design Kconfig.  The effective build config is the
+# overlay alp.conf emitted from board.yaml by `tan build`
+# at build time (see README.md: `tan generate --target zephyr-conf`) -- it turns the
+# `iot: {wifi, tls}` toggles + `libraries: [mbedtls]` into the
+# CONFIG_* the app needs (Wi-Fi, the MQTT client, mbedtls).
+#
+# mbedtls used to be forced OFF here and in a native_sim.conf, because
+# the pinned mbedtls' ssl_misc.h uses `mbedtls_error_pair_t` with PSA
+# crypto off and does not compile.  That is fixed at its root -- the SDK
+# now turns mbedtls' PSA core on with mbedtls itself, see
+# ALP_SDK_MBEDTLS_PSA_CRYPTO in zephyr/Kconfig.alp-libraries (#2173) --
+# so every target, native_sim included, builds the same TLS-enabled
+# configuration the SoM does.