menu "relay-zephyr app options"

config APP_BASE_STATION
	bool "Build as the network base station (WiFi + syslog + telnet)"
	help
	  Selects the base-station variant of this app: adds WiFi, a syslog
	  log backend, and a telnet shell on top of the same frame/CBF/
	  topology code every node shares. Off by default - the sign/relay
	  nodes stay UART-supervised with no networking at all.

config DISABLE_MAC_VERIFY
	bool "TEST ONLY: short-circuit group_mac_verify() to always pass"
	help
	  group_mac_verify() returns true unconditionally, without even
	  computing the real HMAC. For bench/range testing when the group
	  key hasn't been provisioned the same on every unit, or when
	  isolating a bug from the MAC check itself. See APP_BUILD_ID's
	  "-NOAUTH" suffix (CMakeLists.txt) - sign/relay logs only ever
	  prove what build tag was running, so that suffix is the actual
	  guardrail against this reaching a fielded unit unnoticed. Never
	  enable for anything but a bench/test build.

config DISABLE_PUBKEY_VERIFY
	bool "TEST ONLY: short-circuit ident_verify() to always pass"
	help
	  ident_verify() returns true unconditionally, without even
	  importing the key or checking the signature. For bench/range
	  testing before a real pubkey table/base identity key is
	  provisioned on every unit. See APP_BUILD_ID's "-NOAUTH" suffix
	  (CMakeLists.txt). Never enable for anything but a bench/test
	  build.

endmenu

source "Kconfig.zephyr"