diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3cecf92c03..b72f97cf4e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,6 +33,16 @@ env:
 # =============================================================================
 
 jobs:
+  schema_test:
+    name: Test Release Schema Exporter
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -B -m unittest discover -s tools/codegen -p test_release_schema.py -v
+
   # cmake needs 3 semver components and no leading "v"
   version:
     name: "Resolve Version"
@@ -79,11 +89,13 @@ jobs:
             os: macos-15-intel
             os_arch: x86-64
             cmake_arch: x86_64
+            schema_arch: amd64
             artifact_name: osquery-macos-x64
           - name: "macOS ARM64"
             os: macos-15 # pinned: Xcode 26 on macos-latest fails to compile boost mpl
             os_arch: arm64
             cmake_arch: arm64
+            schema_arch: arm64
             artifact_name: osquery-macos-arm64
 
     steps:
@@ -164,6 +176,29 @@ jobs:
           
           echo "Build completed successfully"
 
+      # Export CMake-selected .table files to JSON; SELECTs check version, columns and aliases in the built binary.
+      # Verification must pass before JSON is written; it does not test JOINs or device data.
+      - name: Export and verify release schema
+        env:
+          RELEASE_TAG: ${{ inputs.version || 'latest' }}
+          OSQUERY_VERSION: ${{ needs.version.outputs.version }}
+          SOURCE_COMMIT: ${{ github.sha }}
+        run: |
+          python3 tools/codegen/release_schema.py variant \
+            --native-specs build/specs/native_specs.txt \
+            --foreign-specs build/specs/foreign_specs.txt \
+            --platform darwin --architecture '${{ matrix.schema_arch }}' \
+            --release-tag "$RELEASE_TAG" --osquery-version "$OSQUERY_VERSION" \
+            --source-commit "$SOURCE_COMMIT" --binary build/osquery/osqueryd \
+            --output schema/osquery-schema.json
+
+      - name: Upload schema variant
+        uses: actions/upload-artifact@v4
+        with:
+          name: schema-darwin-${{ matrix.schema_arch }}
+          path: schema/osquery-schema.json
+          if-no-files-found: error
+
       - name: ccache statistics
         if: always()
         run: ccache --show-stats
@@ -266,6 +301,10 @@ jobs:
 
       - name: Setup MSBuild
         uses: microsoft/setup-msbuild@v2
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
       
       - name: Setup Visual Studio Build Tools
         uses: ilammy/msvc-dev-cmd@v1
@@ -283,6 +322,29 @@ jobs:
           cd build
           cmake --build . --config RelWithDebInfo -j10
 
+      # Export and verify the Windows schema against the built executable, before signing.
+      - name: Export and verify release schema
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ inputs.version || 'latest' }}
+          OSQUERY_VERSION: ${{ needs.version.outputs.version }}
+          SOURCE_COMMIT: ${{ github.sha }}
+        run: |
+          python tools/codegen/release_schema.py variant \
+            --native-specs build/specs/native_specs.txt \
+            --foreign-specs build/specs/foreign_specs.txt \
+            --platform windows --architecture amd64 \
+            --release-tag "$RELEASE_TAG" --osquery-version "$OSQUERY_VERSION" \
+            --source-commit "$SOURCE_COMMIT" --binary build/osquery/RelWithDebInfo/osqueryd.exe \
+            --output schema/osquery-schema.json
+
+      - name: Upload schema variant
+        uses: actions/upload-artifact@v4
+        with:
+          name: schema-windows-amd64
+          path: schema/osquery-schema.json
+          if-no-files-found: error
+
       - name: Sign Windows package
         uses: ./.github/steps/sign-windows-package
         with:
@@ -307,7 +369,7 @@ jobs:
 
   release:
     name: "Create Release"
-    needs: [build_macos, create_universal_macos, build_windows]
+    needs: [schema_test, build_macos, create_universal_macos, build_windows]
     runs-on: ubuntu-latest
     if: |
       github.event_name == 'push' ||
@@ -324,6 +386,19 @@ jobs:
         with:
           path: release-artifacts
 
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      # Merge the three build catalogs only when their release, source and version match.
+      - name: Aggregate matching build schemas
+        run: |
+          python tools/codegen/release_schema.py aggregate \
+            --variants release-artifacts/schema-darwin-amd64/osquery-schema.json \
+              release-artifacts/schema-darwin-arm64/osquery-schema.json \
+              release-artifacts/schema-windows-amd64/osquery-schema.json \
+            --output final-artifacts/osquery-schema.json
+
       - name: Prepare release artifacts
         run: |
           set -e
@@ -350,12 +425,20 @@ jobs:
 
           ls -lh final-artifacts/clients/
 
+      - name: Hash release artifacts
+        run: |
+          cd final-artifacts
+          sha256sum osquery-schema.json clients/* > SHA256SUMS
+
       - name: Generate release header
         run: |
           cat > RELEASE_HEADER.md <<EOF
           ## OSQuery Clients
           - **macOS** (Universal): \`osquery-macos-universal.tar.gz\`
           - **Windows** (amd64): \`osquery-windows-amd64.zip\`
+          - **Versioned table schema**: \`osquery-schema.json\`
+          - **Schema SHA-256**: \`osquery-schema.json.sha256\`
+          - **Checksums**: \`SHA256SUMS\`
           EOF
 
       - name: Delete existing latest release
@@ -364,6 +447,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release delete latest --yes --cleanup-tag || true
 
+      # Publish JSON as a separate release asset beside the binaries.
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
@@ -373,5 +457,9 @@ jobs:
           prerelease: ${{ github.event_name == 'push' }}
           token: ${{ secrets.GITHUB_TOKEN }}
           body_path: RELEASE_HEADER.md
+          fail_on_unmatched_files: true
           files: |
             final-artifacts/clients/*
+            final-artifacts/osquery-schema.json
+            final-artifacts/osquery-schema.json.sha256
+            final-artifacts/SHA256SUMS
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 98c462a6e92..5ea6ed638ba 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -32,6 +32,17 @@ env:
 # =============================================================================
 
 jobs:
+  # Unit-test the exporter with .table fixtures and simulated binary replies.
+  schema_test:
+    name: Test Release Schema Exporter
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -B -m unittest discover -s tools/codegen -p test_release_schema.py -v
+
   build_macos:
     name: "Build C Client for (${{ matrix.os }} ${{ matrix.os_arch }})"
     runs-on: ${{ matrix.os }}
@@ -47,11 +58,13 @@ jobs:
             os: macos-15-intel
             os_arch: x86-64
             cmake_arch: x86_64
+            schema_arch: amd64
             artifact_name: osquery-macos-x64
           - name: "macOS ARM64"
             os: macos-15 # pinned: Xcode 26 on macos-latest fails to compile boost mpl
             os_arch: arm64
             cmake_arch: arm64
+            schema_arch: arm64
             artifact_name: osquery-macos-arm64
     steps:
       - name: Checkout
@@ -131,6 +144,18 @@ jobs:
           
           echo "Build completed successfully"
 
+      # Export CMake-selected .table files; SELECTs check version, columns and aliases in the built binary.
+      - name: Verify built table schema
+        env:
+          SOURCE_COMMIT: ${{ github.sha }}
+        run: |
+          python3 tools/codegen/release_schema.py variant \
+            --native-specs build/specs/native_specs.txt \
+            --foreign-specs build/specs/foreign_specs.txt \
+            --platform darwin --architecture '${{ matrix.schema_arch }}' \
+            --release-tag pr-test --osquery-version 5.9.1 --source-commit "$SOURCE_COMMIT" \
+            --binary build/osquery/osqueryd --output schema/osquery-schema.json
+
       - name: ccache statistics
         if: always()
         run: ccache --show-stats
@@ -158,6 +183,10 @@ jobs:
 
       - name: Setup MSBuild
         uses: microsoft/setup-msbuild@v2
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
       
       - name: Setup Visual Studio Build Tools
         uses: ilammy/msvc-dev-cmd@v1
@@ -175,9 +204,22 @@ jobs:
           cd build
           cmake --build . --config RelWithDebInfo -j10
 
+      # Verify the exported Windows schema against the built executable.
+      - name: Verify built table schema
+        shell: bash
+        env:
+          SOURCE_COMMIT: ${{ github.sha }}
+        run: |
+          python tools/codegen/release_schema.py variant \
+            --native-specs build/specs/native_specs.txt \
+            --foreign-specs build/specs/foreign_specs.txt \
+            --platform windows --architecture amd64 \
+            --release-tag pr-test --osquery-version 5.9.1 --source-commit "$SOURCE_COMMIT" \
+            --binary build/osquery/RelWithDebInfo/osqueryd.exe --output schema/osquery-schema.json
+
   all-checks:
     name: "All Checks"
-    needs: [build_macos, build_windows]
+    needs: [schema_test, build_macos, build_windows]
     runs-on: ubuntu-latest
     if: always()
     steps:
diff --git a/tools/codegen/CMakeLists.txt b/tools/codegen/CMakeLists.txt
index 8733808e33e..f6766b59de4 100644
--- a/tools/codegen/CMakeLists.txt
+++ b/tools/codegen/CMakeLists.txt
@@ -118,6 +118,8 @@ function(generateTables category)
     list(APPEND table_spec_list "${CMAKE_SOURCE_DIR}/specs/${relative_table_spec}")
   endforeach()
 
+  file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/${category}_specs.txt" "${table_spec_list}")
+
   # Iterate through each table spec file
   set(output_folder "${CMAKE_CURRENT_BINARY_DIR}/${category}")
 
diff --git a/tools/codegen/RELEASE_SCHEMA.md b/tools/codegen/RELEASE_SCHEMA.md
new file mode 100644
index 00000000000..976fadf7eb8
--- /dev/null
+++ b/tools/codegen/RELEASE_SCHEMA.md
@@ -0,0 +1,56 @@
+# Released osquery schema
+
+The osquery release publishes `osquery-schema.json` and
+`osquery-schema.json.sha256` alongside the macOS universal and Windows binaries.
+The JSON is generated from the same checkout and CMake-selected specs as each
+binary. Publication requires all three build variants and matching provenance.
+
+## Contract (formatVersion 1)
+
+- `releaseTag`: exact GitHub release tag, including a leading `v` when supplied.
+- `osqueryVersion`: resolved CMake engine version (the fork release version).
+- `sourceCommit`: full 40-character checkout commit SHA.
+- `variants`: Darwin amd64, Darwin arm64, Windows amd64; each has `platform`,
+  `architecture` and `tables`.
+- Table: `name`, `aliases` (string array), `description`, `notes`, `url` (strings),
+  `examples` (string array), `availability`, `attributes` (spec attribute object),
+  `foreignKeys` (`{column, table}` array), `columns`.
+- Column: `name`, `aliases` (string array), SQL `type` (lowercase), `description`,
+  `notes`, `platforms` (string array), `options` (spec options object such as
+  `required`, `hidden`, `index`, `optimized`, `additional`, `collate`).
+
+`availability` is `native`, `foreign` or `disabled`. Foreign tables are registered
+empty-result placeholders. They do not establish native platform support.
+Platform-specific columns retain their platform list; an empty list means no
+column-level restriction within that variant. Hidden columns can be selected
+explicitly and are not automatically invalid SQL. Runtime event configuration,
+permissions and extensions remain separate from compiled schema availability.
+
+The checksum is SHA-256 of the exact complete JSON asset bytes, before decoding
+or reserialization. The sidecar uses `HASH  osquery-schema.json\n`, with a lowercase
+64-character hexadecimal hash. There is no embedded checksum or canonical JSON
+requirement. `SHA256SUMS` additionally covers the schema and binary archives.
+
+## Build and release checks
+
+CMake writes `build/specs/native_specs.txt` and `foreign_specs.txt` using its actual
+selected source lists. `release_schema.py variant` reads those manifests, applies
+the target platform to the upstream spec parser, and verifies version, table,
+column and alias registration using the just-built executable in shell mode.
+Metadata queries do not execute the table's data collection query.
+
+`release_schema.py aggregate` requires exactly the three supported variants with
+the same format, release tag, engine version and source commit. Release and PR CI
+run the exporter tests; each platform build verifies its own schema.
+
+The existing mutable `latest` prerelease retains its exact source and engine
+provenance. It does not prove a device has that build. Consumers must distinguish
+catalog provenance from verified installed platform, architecture and version.
+Older releases without an artifact remain unconfirmed rather than falling back
+to another version's schema.
+
+Run the local exporter tests with:
+
+```sh
+python3 -B -m unittest discover -s tools/codegen -p test_release_schema.py -v
+```
diff --git a/tools/codegen/release_schema.py b/tools/codegen/release_schema.py
new file mode 100644
index 00000000000..704041945b7
--- /dev/null
+++ b/tools/codegen/release_schema.py
@@ -0,0 +1,198 @@
+#!/usr/bin/env python3
+"""Publish the table specs selected for each released osquery binary."""
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+
+import gentable
+
+
+REQUIRED_VARIANTS = {("darwin", "amd64"), ("darwin", "arm64"), ("windows", "amd64")}
+PROVENANCE_FIELDS = ("formatVersion", "releaseTag", "osqueryVersion", "sourceCommit")
+
+
+def selected_specs(manifest, source_root):
+    # Use CMake's selected files, not every .table file in the repository.
+    paths = [Path(value).resolve() for value in manifest.read_text(encoding="utf-8").strip().split(";") if value]
+    specs_root = (source_root / "specs").resolve()
+    for path in paths:
+        if specs_root not in path.parents or path.suffix != ".table" or not path.is_file():
+            raise ValueError("Invalid selected spec: {}".format(path))
+    if len(set(paths)) != len(paths):
+        raise ValueError("Duplicate specs in {}".format(manifest))
+    return paths
+
+
+def platform_names(platforms):
+    return sorted({"windows" if name in gentable.WINDOWS else name for name in platforms})
+
+
+def table_metadata(path, platform, availability, source_root, source_commit):
+    # Reuse osquery's generator for the target OS, resetting its state for each table.
+    gentable.PLATFORM = "win32" if platform == "windows" else platform
+    gentable.table.__init__()
+    namespace = dict(vars(gentable))
+    exec(compile(path.read_text(encoding="utf-8"), str(path), "exec"), namespace)
+    table = gentable.table
+    if not table.table_name or not table.columns() or not table.function:
+        raise ValueError("Incomplete table spec: {}".format(path))
+    if gentable.is_denylisted(table.table_name, path=str(path)):
+        availability = "disabled"
+    return {
+        "name": table.table_name,
+        "aliases": table.aliases,
+        "description": table.description,
+        "notes": table.notes,
+        "examples": table.examples,
+        "attributes": table.attributes,
+        "availability": availability,
+        "url": "https://github.com/flamingo-stack/osquery/blob/{}/{}".format(
+            source_commit, path.relative_to(source_root).as_posix()),
+        "columns": [{
+            "name": column.name,
+            "aliases": column.aliases,
+            "type": column.type.affinity.replace("_TYPE", "").lower(),
+            "description": column.description,
+            "notes": column.notes,
+            "platforms": platform_names(column.platforms),
+            "options": column.options,
+        } for column in table.columns()],
+        "foreignKeys": [{"column": key.column, "table": key.table} for key in table.foreign_keys()],
+    }
+
+
+def export_variant(source_root, native_manifest, foreign_manifest, platform, architecture,
+                   release_tag, osquery_version, source_commit):
+    source_root = Path(source_root).resolve()
+    if (platform, architecture) not in REQUIRED_VARIANTS:
+        raise ValueError("Unsupported release platform/architecture")
+    if not re.fullmatch(r"[0-9a-f]{40}", source_commit):
+        raise ValueError("sourceCommit must be the full source commit SHA")
+    if not release_tag or not re.fullmatch(r"\d+\.\d+\.\d+", osquery_version):
+        raise ValueError("Missing release tag or invalid osquery version")
+    # Foreign tables describe other platforms; only native tables are verified below.
+    native = selected_specs(Path(native_manifest), source_root)
+    foreign = selected_specs(Path(foreign_manifest), source_root)
+    if not native or set(native) & set(foreign):
+        raise ValueError("Native selection is empty or overlaps foreign selection")
+    tables = sorted(
+        [table_metadata(path, platform, availability, source_root, source_commit)
+         for paths, availability in ((native, "native"), (foreign, "foreign")) for path in paths],
+        key=lambda table: table["name"],
+    )
+    if len({table["name"] for table in tables}) != len(tables):
+        raise ValueError("Duplicate selected table names")
+    variants = [{"platform": platform, "architecture": architecture, "tables": tables}]
+    return {"formatVersion": 1, "releaseTag": release_tag, "osqueryVersion": osquery_version,
+            "sourceCommit": source_commit, "variants": variants}
+
+
+def aggregate(parts):
+    if not parts:
+        raise ValueError("No schema variants")
+    provenance = {field: parts[0][field] for field in PROVENANCE_FIELDS}
+    variants = []
+    for part in parts:
+        if any(part.get(field) != value for field, value in provenance.items()):
+            raise ValueError("Schema variants have different source/version provenance")
+        variants.extend(part["variants"])
+    keys = [(variant["platform"], variant["architecture"]) for variant in variants]
+    if set(keys) != REQUIRED_VARIANTS or len(keys) != len(REQUIRED_VARIANTS):
+        raise ValueError("Release needs exactly darwin/amd64, darwin/arm64 and windows/amd64")
+    variants.sort(key=lambda variant: (variant["platform"], variant["architecture"]))
+    return dict(provenance, variants=variants)
+
+
+def write_artifact(artifact, output):
+    raw = (json.dumps(artifact, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
+    output.parent.mkdir(parents=True, exist_ok=True)
+    output.write_bytes(raw)
+    checksum = hashlib.sha256(raw).hexdigest() + "  " + output.name + "\n"
+    output.with_name(output.name + ".sha256").write_text(checksum, encoding="ascii")
+
+
+def verify_binary(artifact, binary):
+    """Check version and SQL column/alias registration without reading table data."""
+    # Isolate the schema check from installed extensions and existing osquery state.
+    with tempfile.TemporaryDirectory(prefix="osquery-schema-") as scratch:
+        config = Path(scratch) / "config.json"
+        config.write_text("{}", encoding="utf-8")
+        def query(sql):
+            result = subprocess.run(
+                [str(Path(binary).resolve()), "-S", "--json", "--disable_extensions",
+                 "--disable_events", "--disable_logging", "--config_plugin=filesystem",
+                 "--config_path=" + str(config), "--database_path=" + str(Path(scratch) / "db"), sql],
+                capture_output=True, text=True, check=True, timeout=30,
+            )
+            return json.loads(result.stdout)
+
+        rows = query("select version from osquery_info;")
+        if len(rows) != 1 or rows[0]["version"] != artifact["osqueryVersion"]:
+            raise ValueError("Built binary version differs from schema version")
+        for table in artifact["variants"][0]["tables"]:
+            if table["availability"] != "native":
+                continue
+            all_columns = {column["name"] for column in table["columns"]}
+            visible_columns = {column["name"] for column in table["columns"]
+                               if not column["options"].get("hidden", False)}
+            for name in [table["name"]] + table["aliases"]:
+                # Canonical tables expose hidden columns; table aliases omit them.
+                expected = all_columns if name == table["name"] else visible_columns
+                escaped = name.replace("'", "''")
+                columns = query("select name from pragma_table_xinfo('{}');".format(escaped))
+                names = {column["name"] for column in columns}
+                # This checks advertised columns, not omitted columns or column types.
+                if not expected <= names:
+                    raise ValueError("Built table {} missing columns {}".format(name, sorted(expected - names)))
+            for column in table["columns"]:
+                for alias in column["aliases"]:
+                    if not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", alias):
+                        raise ValueError("Unexpected SQL column alias: {}".format(alias))
+                    quoted_table = table["name"].replace('"', '""')
+                    # LIMIT 0 checks alias syntax without fetching device data.
+                    query('select [{}] from "{}" limit 0;'.format(alias, quoted_table))
+
+
+def main():
+    parser = argparse.ArgumentParser(__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    variant = commands.add_parser("variant")
+    variant.add_argument("--source-root", type=Path, default=Path(__file__).resolve().parents[2])
+    variant.add_argument("--native-specs", type=Path, required=True)
+    variant.add_argument("--foreign-specs", type=Path, required=True)
+    variant.add_argument("--platform", choices=("darwin", "windows"), required=True)
+    variant.add_argument("--architecture", choices=("amd64", "arm64"), required=True)
+    variant.add_argument("--release-tag", required=True)
+    variant.add_argument("--osquery-version", required=True)
+    variant.add_argument("--source-commit", required=True)
+    variant.add_argument("--binary", type=Path)
+    variant.add_argument("--output", type=Path, required=True)
+    merge = commands.add_parser("aggregate")
+    merge.add_argument("--variants", type=Path, nargs="+", required=True)
+    merge.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    if args.command == "variant":
+        artifact = export_variant(args.source_root, args.native_specs, args.foreign_specs,
+                                  args.platform, args.architecture, args.release_tag,
+                                  args.osquery_version, args.source_commit)
+        if args.binary:
+            verify_binary(artifact, args.binary)
+    else:
+        artifact = aggregate([json.loads(path.read_text(encoding="utf-8")) for path in args.variants])
+    write_artifact(artifact, args.output)
+    print("Exported {} variant(s), {} tables: {}".format(
+        len(artifact["variants"]), sum(len(v["tables"]) for v in artifact["variants"]), args.output))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (ValueError, OSError, subprocess.SubprocessError) as error:
+        print("Schema export failed: {}".format(error), file=sys.stderr)
+        sys.exit(1)
diff --git a/tools/codegen/test_release_schema.py b/tools/codegen/test_release_schema.py
new file mode 100644
index 00000000000..8a524ed75c8
--- /dev/null
+++ b/tools/codegen/test_release_schema.py
@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Release schemas must describe the selected build, including valid SQL aliases."""
+
+import importlib.util
+import hashlib
+import json
+from pathlib import Path
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+import subprocess
+
+
+MODULE_PATH = Path(__file__).with_name("release_schema.py")
+SPEC = '''table_name("sample", aliases=["sample_alias"])
+description("A sample table.")
+schema([
+    Column("path", TEXT, "Path", aliases=["location"], required=True, optimized=True),
+    ForeignKey(column="path", table="file"),
+])
+extended_schema(WINDOWS, [Column("windows_only", INTEGER, "Windows value")])
+notes("Needs permission.")
+examples(["select location from sample_alias where path = '/tmp'"])
+attributes(cacheable=True)
+implementation("sample@genSample")
+'''
+
+
+class ReleaseSchemaTest(unittest.TestCase):
+    def setUp(self):
+        self.assertTrue(MODULE_PATH.exists(), "release schema exporter is missing")
+        spec = importlib.util.spec_from_file_location("release_schema", MODULE_PATH)
+        self.exporter = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(self.exporter)
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        (self.root / "specs").mkdir()
+        self.sample = self.root / "specs/sample.table"
+        self.sample.write_text(SPEC)
+        self.native = self.root / "native.txt"
+        self.foreign = self.root / "foreign.txt"
+        self.native.write_text(str(self.sample))
+        self.foreign.write_text("")
+
+    def variant(self, platform="darwin", architecture="arm64"):
+        return self.exporter.export_variant(
+            self.root, self.native, self.foreign, platform, architecture,
+            "0.0.8", "0.0.8", "a" * 40,
+        )
+
+    def test_preserves_aliases_constraints_examples_and_foreign_keys(self):
+        table = self.variant()["variants"][0]["tables"][0]
+        self.assertEqual(table["aliases"], ["sample_alias"])
+        self.assertEqual(table["columns"][0]["aliases"], ["location"])
+        self.assertEqual(table["columns"][0]["options"], {"required": True, "optimized": True})
+        self.assertEqual(table["foreignKeys"], [{"column": "path", "table": "file"}])
+        self.assertEqual(table["notes"], "Needs permission.")
+        self.assertEqual(table["examples"], ["select location from sample_alias where path = '/tmp'"])
+        self.assertEqual(table["availability"], "native")
+
+    def test_platform_columns_do_not_depend_on_exporter_host(self):
+        darwin = self.variant()["variants"][0]["tables"][0]["columns"][1]
+        windows = self.variant("windows", "amd64")["variants"][0]["tables"][0]["columns"][1]
+        self.assertEqual(darwin["platforms"], ["windows"])
+        self.assertTrue(darwin["options"]["hidden"])
+        self.assertNotIn("hidden", windows["options"])
+
+    def test_only_cmake_selected_specs_are_exported_and_foreign_is_marked(self):
+        (self.root / "specs/unselected.table").write_text(SPEC.replace("sample", "unselected"))
+        other = self.root / "specs/other.table"
+        other.write_text(SPEC.replace("sample", "other"))
+        self.foreign.write_text(str(other))
+        tables = self.variant()["variants"][0]["tables"]
+        self.assertEqual([(t["name"], t["availability"]) for t in tables],
+                         [("other", "foreign"), ("sample", "native")])
+
+    def test_rejects_specs_outside_source_and_empty_native_selection(self):
+        self.native.write_text(str(self.root / "outside.table"))
+        with self.assertRaises(ValueError):
+            self.variant()
+        self.native.write_text("")
+        with self.assertRaises(ValueError):
+            self.variant()
+
+    def test_rejects_duplicate_native_foreign_spec(self):
+        self.foreign.write_text(str(self.sample))
+        with self.assertRaises(ValueError):
+            self.variant()
+
+    def test_aggregation_requires_three_variants_with_matching_provenance(self):
+        parts = [self.variant("darwin", "amd64"), self.variant(), self.variant("windows", "amd64")]
+        artifact = self.exporter.aggregate(parts)
+        self.assertEqual([(v["platform"], v["architecture"]) for v in artifact["variants"]],
+                         [("darwin", "amd64"), ("darwin", "arm64"), ("windows", "amd64")])
+        self.assertEqual(artifact["sourceCommit"], "a" * 40)
+        with self.assertRaises(ValueError):
+            self.exporter.aggregate(parts[:2])
+        parts[2]["sourceCommit"] = "b" * 40
+        with self.assertRaises(ValueError):
+            self.exporter.aggregate(parts)
+
+    def test_rejects_duplicate_variant(self):
+        parts = [self.variant("darwin", "amd64"), self.variant(), self.variant("windows", "amd64")]
+        with self.assertRaises(ValueError):
+            self.exporter.aggregate(parts + [parts[0]])
+
+    def test_sidecar_hashes_exact_utf8_bytes_without_reserializing(self):
+        first = self.variant()
+        first["variants"][0]["tables"][0]["notes"] = "Permissions — needed"
+        output = self.root / "osquery-schema.json"
+        self.assertTrue(hasattr(self.exporter, "write_artifact"), "raw checksum writer is missing")
+        self.exporter.write_artifact(first, output)
+        raw = output.read_bytes()
+        checksum = output.with_name("osquery-schema.json.sha256").read_text()
+        self.assertEqual(checksum, hashlib.sha256(raw).hexdigest() + "  osquery-schema.json\n")
+        self.assertNotIn("schemaSha256", first)
+        self.assertEqual(json.loads(raw)["variants"][0]["tables"][0]["notes"], "Permissions — needed")
+        self.assertEqual(json.loads(json.dumps(first))["formatVersion"], 1)
+
+    def binary_query(self, version="0.0.8", columns=("path", "windows_only"), missing_alias=False,
+                     table_alias_columns=None):
+        def run(command, **kwargs):
+            sql = command[-1]
+            if sql == "select version from osquery_info;":
+                rows = [{"version": version}]
+            elif sql == "select name from pragma_table_xinfo('sample');":
+                rows = [{"name": name} for name in columns]
+            elif sql == "select name from pragma_table_xinfo('sample_alias');":
+                rows = [{"name": name} for name in
+                        (columns if table_alias_columns is None else table_alias_columns)]
+            elif sql == 'select [location] from "sample" limit 0;':
+                if missing_alias:
+                    raise subprocess.CalledProcessError(1, command, stderr="no such column: location")
+                rows = []
+            else:
+                raise AssertionError("Unexpected binary SQL: {}".format(sql))
+            return SimpleNamespace(stdout=json.dumps(rows))
+        return run
+
+    def test_binary_verification_rejects_wrong_engine_version(self):
+        with patch.object(self.exporter.subprocess, "run", side_effect=self.binary_query(version="0.0.7")):
+            with self.assertRaisesRegex(ValueError, "version differs"):
+                self.exporter.verify_binary(self.variant(), self.root / "osqueryd")
+
+    def test_binary_verification_rejects_missing_table_or_column(self):
+        for columns in ((), ("path",)):
+            with self.subTest(columns=columns):
+                with patch.object(self.exporter.subprocess, "run", side_effect=self.binary_query(columns=columns)):
+                    with self.assertRaisesRegex(ValueError, "missing columns"):
+                        self.exporter.verify_binary(self.variant(), self.root / "osqueryd")
+
+    def test_binary_verification_rejects_missing_column_alias_using_identifier_sql(self):
+        with patch.object(self.exporter.subprocess, "run", side_effect=self.binary_query(missing_alias=True)):
+            with self.assertRaises(subprocess.CalledProcessError):
+                self.exporter.verify_binary(self.variant(), self.root / "osqueryd")
+
+    def test_binary_verification_does_not_treat_foreign_tables_as_supported(self):
+        artifact = self.variant()
+        artifact["variants"][0]["tables"][0]["availability"] = "foreign"
+        with patch.object(self.exporter.subprocess, "run", side_effect=self.binary_query(columns=())):
+            self.exporter.verify_binary(artifact, self.root / "osqueryd")
+
+    def test_binary_verification_accepts_registered_table_and_column_aliases(self):
+        with patch.object(self.exporter.subprocess, "run", side_effect=self.binary_query()):
+            self.exporter.verify_binary(self.variant(), self.root / "osqueryd")
+
+    def test_binary_verification_accepts_table_alias_without_hidden_columns(self):
+        with patch.object(self.exporter.subprocess, "run",
+                          side_effect=self.binary_query(table_alias_columns=("path",))):
+            self.exporter.verify_binary(self.variant(), self.root / "osqueryd")
+
+    def test_binary_verification_rejects_table_alias_missing_visible_columns(self):
+        for platform, columns in (("darwin", ()), ("windows", ("path",))):
+            with self.subTest(platform=platform):
+                with patch.object(self.exporter.subprocess, "run",
+                                  side_effect=self.binary_query(table_alias_columns=columns)):
+                    with self.assertRaisesRegex(ValueError, "sample_alias missing columns"):
+                        self.exporter.verify_binary(self.variant(platform, "amd64"), self.root / "osqueryd")
+
+
+if __name__ == "__main__":
+    unittest.main()