Doc fixes and proper agents files

[Frauschi]

Problem

• Stale interop section: the README said the interop scripts are run by hand and that wolfSSL rejects micromdm's and step-ca's SCEP ("stricter PKCS#7 verification", "EnvelopedData key-wrap algorithm"). The nightly Interop workflow runs them, and every peer passes. The old step-ca failure was BAD_KEYWRAP_ALG_E from its default ECDSA RA, not a key-wrap algorithm wolfSSL refuses.
• Non-existent CryptoCb API: docs/ARCHITECTURE.md sections 4.2 and 4.7 and CLAUDE.md told integrators to call wolfCrypt_CryptoCb_RegisterDevice, which does not exist.
• Wrong SCEP routing claim: docs/ARCHITECTURE.md section 2 said wolfcert_client_enroll / _reenroll route to EST or SCEP, and wolfcert/client.h said wolfcert_client_fetch_meta queries SCEP capabilities. Only wolfcert_client_get_ca handles SCEP; the others return WOLFCERT_ERR_UNSUPPORTED for it.
• Wrong verify_server comment: wolfcert/types.h described verify_server 0 as an explicit-trust-anchor bootstrap. EST refuses it on every call, /cacerts included, and SCEP refuses it on an https:// URL, both with WOLFCERT_ERR_TLS.
• CLAUDE.md written for the wrong reader: it covered the dev build, ctest, internal error macros, symbol visibility and license headers, which help someone working on wolfCert but not an agent helping a user build wolfCert into a product. Agents other than Claude Code also look for AGENTS.md, not CLAUDE.md.
• Docs missing from make dist: EXTRA_DIST listed only README.md, docs/ARCHITECTURE.md and docs/EMBEDDED.md, so the tarball lacked docs/INTEROP.md, docs/CI.md, docs/MIGRATING-FROM-WOLFSCEP.md and the agent files that the other docs point at.
• No tracked contributor guide: once CLAUDE.md moved to integrators, the wolfCert-specific rules (error macros, visibility, license header, include order, the Zephyr board checklist) had no tracked home.

Fix

• Correct stale interop and client API claims in the docs: the README interop section now says the nightly workflow runs every peer and all of them pass. It keeps the caveats that still apply: micromdm needs --enable-des3, step-ca's SCEP needs an RSA CA chain, and open-source step-ca has no EST. It also points at docs/INTEROP.md, whose introduction no longer calls the scripts hand-run. The CryptoCb call is renamed to wc_CryptoCb_RegisterDevice, and ARCHITECTURE and client.h say which wolfcert_client_* calls are EST-only. The verify_server field comment says it must be 1 for EST and https:// SCEP. EXTRA_DIST now ships the three missing docs/ files. Only header comments change; no code.

• Turn CLAUDE.md into an integrator-focused AGENTS.md: follows wolfSSL's split. AGENTS.md is written for integrators:

  • choosing an integration path
  • the wolfSSL features wolfCert needs and the canonical configure line
  • CMake and autoconf options side by side
  • the configuration model, and when to pick EST or SCEP
  • a minimal enrollment flow
  • the public headers and porting hooks
  • checking an integration against wolfcert-server
  • gotchas

  CLAUDE.md becomes @AGENTS.md. .gitignore lists the untracked AGENTS.local.md / CLAUDE.local.md for machine-specific notes. docs/EMBEDDED.md and scripts/ci/build-wolfssl.sh now point at AGENTS.md, and EXTRA_DIST ships AGENTS.md and CLAUDE.md.

• Add CONTRIBUTING.md: wolfSSL's shared contributor guide, without the Jenkins and wolfSSL-Bot paragraphs since wolfCert's CI is GitHub Actions only, plus a "wolfCert Specifics" section with the project rules and the full Zephyr board checklist. AGENTS.md points contributors at it.

Notes for reviewers

• ARCHITECTURE section 4.2 still says TLS client auth and SCEP pkiMessage signing go through the CryptoCb dev_id. Today they export the private key instead (wolfSSL_CTX_use_PrivateKey_buffer in src/http.c, wolfcert_key_to_pem in EST reenroll, rsa_key_to_der in the SCEP client). A follow-up PR fixes the code to match, so this PR leaves that paragraph alone.

Tests

• Docs only, apart from two comment blocks in wolfcert/client.h and one field comment in wolfcert/types.h. A -DWOLFCERT_WERROR=ON build against wolfSSL 5.9.4 has no warnings, and ctest passes 30/30. make dist ships every Markdown file the other docs reference, apart from the gitignored *.local.md files and examples/certs/README.md (the tarball has never included examples/certs/).
• The verify_server wording was checked by running with verify_server = 0: EST get_ca and SCEP GetCACert over https:// return WOLFCERT_ERR_TLS (-5) before connecting, and SCEP over http:// passes the check.
• The enrollment snippet in AGENTS.md was compiled as written and run against a local wolfcert-server --proto est. It enrolls, and fails with ASN_NO_SIGNER_E (-188) when given the wrong trust anchor.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new integration guide contains inaccurate transport, CryptoCb, and asynchronous-session guidance.

Review effort: Balanced
Findings: 1

Open (1)

• Correct SCEP transport support in comparison table · New

What changed in this PR

Updates integration guidance and corrects stale protocol, interoperability, and CryptoCb documentation.

Changes:

• Adds an integrator-focused AGENTS.md and redirects Claude guidance to it.
• Corrects EST/SCEP API, TLS verification, and interoperability descriptions.
• Updates related references and ignores local agent instruction files.

File	Description
.gitignore	Ignores local agent instructions.
AGENTS.md	Adds the integration guide.
CLAUDE.md	Redirects to AGENTS.md.
README.md	Updates interoperability status.
docs/​ARCHITECTURE.md	Corrects API routing and CryptoCb naming.
docs/​EMBEDDED.md	Updates guide references.
scripts/​ci/​build-wolfssl.sh	Updates the canonical guide reference.
wolfcert/​client.h	Clarifies EST-only client operations.
wolfcert/​types.h	Clarifies server-verification requirements.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[yosuke-wolfssl]

The corrected claims all check out against the code. I verified the verify_server checks, the client-API routing, the ECC RA rejection and every API name in the AGENTS.md example.

A few things below:

• CONTRIBUTING.md: this follows wolfSSL's AGENTS.md / CLAUDE.md split, but wolfSSL pairs it with a tracked CONTRIBUTING.md, and wolfCert has none. The wolfCert-specific rules the old CLAUDE.md held now have no tracked home:

  • the WOLFCERT_ERR / WOLFCERT_ERR_WC macros, and wolfcert_strerror covering every code
  • WOLFCERT_TEST_VIS and the hidden-visibility rule
  • the license-header rule and include order
  • the Zephyr board checklist (sample.yaml, zephyr/include.am, the CI job, the README tables); zephyr/README.md "Adding a board" covers only the board files

  If you've already decided these belong in *.local.md, ignore this. Otherwise a CONTRIBUTING.md (wolfSSL's text plus a wolfCert section) would keep them visible to other contributors and review agents.

• EXTRA_DIST: Makefile.am doesn't list AGENTS.md or docs/INTEROP.md, but docs/EMBEDDED.md and README.md now point at them, so a make dist tarball has dangling references.

• docs/INTEROP.md:3 still calls the scripts "hand-run and best-effort", which no longer matches the new README text.

[Frauschi]

Thanks, all three addressed:

• Added CONTRIBUTING.md as a new commit: wolfSSL's shared guide without the Jenkins part, plus a wolfCert section with the rules you listed and the full Zephyr board checklist. AGENTS.md points at it.
• EXTRA_DIST now ships AGENTS.md, CLAUDE.md, CONTRIBUTING.md and every file in docs/ (CI.md and MIGRATING-FROM-WOLFSCEP.md were missing too).
• Reworded the docs/INTEROP.md intro.

[yosuke-wolfssl]

Thanks, CONTRIBUTING.md reads well and the wolfCert section matches the tree.

One thing: two of the shared "What We Look For" rules don't match wolfCert's code:

• C90 declarations / no for (int i = 0; ...): wolfCert builds as C11 (CMAKE_C_STANDARD 11), and src/ has about 29 for (size_t i = 0; ...) loops.
• 80 columns, checked in CI: 448 lines in src/, wolfcert/ and cli/ are over 80 columns, and the Lint workflow doesn't check line length.

Maybe we can take it as follow-up or tailor the rules for wolfCert a bit.

[Frauschi]

Thanks. Tailored both: the declarations bullet now says C11 and follow the file's style, and 80 columns is a soft target for new code that CI doesn't check. Also added two bullets on comment style.