- Add optional Holepunch clone lag gate (holepunch-freshness-gate.json, verify-holepunch-clone-freshness.mjs) and wire into pretest/docs. - Extend stock ctx.bareOsHrpcRequest with disk.os replication routes; bump hrpc_allowlist_sketch proc to schema 2 with stockRoutes list. - Security posture: blindRelayAudit; hyper_multisig_trust_pointer schema 2 + vault multisig continuity env; login/unlock audit hook. - Syscalls schema 9 alignment (JSON schema, compatibility matrix, conformance matrix clock_gettime); boot budget telemetry schema 2 in metrics_live. - Coreutils hostname -s/--short man/options; rebuild kernel bins/man. - POSIX + P2P dashboard section in docs/README; handbook/DOCUMENTATION/ release-checklist/OTA/KERNEL_CONTRACT/PEAR-RUN and related reference updates. - verify-boot-policy-extension-signer-pins: scan kernel init fragments. Note: vendor drift section removed from kernel/lib/bare/README.md (intentional).
Published JSON Schemas (docs/schemas/)
Machine-readable contracts for boot policy, lifecycle telemetry, and kernel extension manifests. Guest and host code may emit or validate lines against these schemas; see developer-guide — Privacy, telemetry, and PII for scrubbing and non-secret posture.
| Schema file | Purpose |
|---|---|
| boot.policy.schema.json | Optional /etc/bare-os/boot.policy.json and related boot gating |
| boot-trace-line.schema.json | Structured boot trace / lifecycle NDJSON lines |
| telemetry-ndjson-record.schema.json | Guest/host NDJSON telemetry mirrors |
| otel-bare-os-jsonl.schema.json | OpenTelemetry JSONL mapping for Bare OS |
| kernel-extension-manifest.schema.json | Extension drop-in manifests under kernel.ext.d |
| kernel-extensions.registry.schema.json | Extension registry aggregation |
| bare-os-security-posture.schema.json | peerAdmission env pointers for optional NDJSON audit (/proc/bare_os/security_posture.json) |
Related: kernel-extensions.md · observability-contracts.md · compatibility-matrix.md · scripts/README.md (verifiers that touch schema examples).