work/boot-provisioning-examples

examples/README.md

@@ -6,6 +6,7 @@ This directory contains one conforming JSON example payload for each top-level s
 
 ## What the examples show
 
+The examples are designed to tell coherent end-to-end stories. The original example set catalogs, governs, transforms, and releases a personal health dataset within an agent session. Newer SourceOS examples show a SourceOS Workstation artifact flowing from content intent through overlays, build request, release manifest, evidence bundle, catalog entry, and access profile. The control-plane examples add the local-first lifecycle proof path: a `ReleaseSet` assigned to an M2 demo device, a `BootReleaseSet` for the recovery/provisioning lane, an `EnrollmentToken` authorizing one-time recovery access, and a `Fingerprint` reporting the realized post-apply state.
 The examples are designed to tell a coherent end-to-end story: a personal health dataset is catalogued, governed, transformed by an obfuscation workload, and released — all within an agent session. They share cross-reference URNs so you can trace the full lifecycle.
 
 The example set now also includes shell/document/publication objects so the same storyline can extend into artifact derivation, signing, validation, annotation export, run reporting, publish decisions, and mirror receipts.
@@ -92,6 +93,9 @@ These examples illustrate the Truth Plane contract additions:
 
 ---
 
+## Recent additions — Control-plane lifecycle and boot provisioning examples
+
+These examples illustrate the local-first control-plane lifecycle and secure boot/recovery family:
 ## Recent additions — Compression Commons examples
 
 These examples illustrate artifact-versus-baseline evaluation using existing SourceOS/SociOS governance, execution, provenance, and reference contracts.
@@ -109,6 +113,8 @@ These examples illustrate the release/build lifecycle schemas added in this slic
 | File | Schema type | Description |
 |------|------------|-------------|
 | `release_set.json` | ReleaseSet | Assigned M2 demo release set with source Git ref, target, profile refs, and boot artifact refs |
+| `boot_release_set.json` | BootReleaseSet | SourceOS Recovery Environment boot artifact set linked to the assigned ReleaseSet |
+| `enrollment_token.json` | EnrollmentToken | One-time recovery authorization token scoped to the M2 demo device and BootReleaseSet |
 | `fingerprint.json` | Fingerprint | Post-apply device observation proving the realized state matches the assigned release set |
 | `config_source.json` | ConfigSource | Git-backed configuration source pinned to a specific commit, consumed by NLBoot/sourceos-boot |
 | `token_door.json` | TokenDoor | One-time recovery-access token door bound to the M2 demo device and release set |

examples/boot_release_set.json

@@ -2,6 +2,14 @@
   "boot_release_set_id": "urn:srcos:boot-release-set:m2-demo-recovery-2026-04-26",
   "base_release_set_ref": "urn:srcos:release-set:m2-demo-2026-04-26",
   "boot_mode": "recovery",
+  "status": "ready",
+  "artifacts": {
+    "kernel_ref": "urn:srcos:artifact:m2-demo-recovery-kernel-sha256-0f3b6d7f",
+    "initrd_ref": "urn:srcos:artifact:m2-demo-recovery-initrd-sha256-08f4c82e",
+    "rootfs_ref": "urn:srcos:artifact:m2-demo-recovery-rootfs-sha256-5f4dcc3b"
+  },
+  "created_at": "2026-04-26T14:30:00Z",
+  "notes": "SourceOS Recovery Environment for the M2 local-first demo. This models the nlboot-evolved recovery path: minimal boot artifacts, signed content-addressed refs, and linkage back to the assigned ReleaseSet."
   "boot_channel": "rescue",
   "status": "ready",
   "platform_entrypoints": [

tools/validate_control_plane_examples.py

@@ -8,6 +8,8 @@
 
 ROOT = Path(__file__).resolve().parents[1]
 PAIRS = [
+    (ROOT / "schemas" / "control-plane" / "ReleaseSet.json", ROOT / "examples" / "release_set.json"),
+    (ROOT / "schemas" / "control-plane" / "Fingerprint.json", ROOT / "examples" / "fingerprint.json"),
     (ROOT / "schemas" / "control-plane" / "BootReleaseSet.json", ROOT / "examples" / "boot_release_set.json"),
     (ROOT / "schemas" / "control-plane" / "EnrollmentToken.json", ROOT / "examples" / "enrollment_token.json"),
 ]
@@ -17,6 +19,7 @@ def validate_pair(schema_path: Path, example_path: Path) -> None:
     schema = json.loads(schema_path.read_text(encoding="utf-8"))
     jsonschema.validators.validator_for(schema).check_schema(schema)
     legacy_ref = schema.get("allOf", [{}])[0].get("$ref")
+    validation_schema_path = schema_path.with_name(legacy_ref) if legacy_ref else schema_path
     validation_schema_path = (schema_path.parent / legacy_ref).resolve() if legacy_ref else schema_path
     validation_schema = json.loads(validation_schema_path.read_text(encoding="utf-8"))
     example = json.loads(example_path.read_text(encoding="utf-8"))