diff --git a/.kitchen.yml b/.kitchen.yml
index b49319d..d7cfa31 100644
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -17,6 +17,7 @@
   state_top:
     base:
       "*":
+        - linux.system.user
         - openssh
   pillars:
     top.sls:
@@ -40,14 +41,15 @@
       platform: ubuntu
 
 suites:
-
   - name: openssh_client
     provisioner:
       pillars-from-files:
-        openssh.sls: tests/pillar/openssh_client.sls
+        openssh.sls: tests/pillar/client.sls
 
   - name: openssh_server
     provisioner:
       pillars-from-files:
-        openssh.sls: tests/pillar/openssh_server.sls
+        openssh.sls: tests/pillar/server.sls
+
+
 # vim: ft=yaml sw=2 ts=2 sts=2 tw=125
diff --git a/Makefile b/Makefile
index 1043fbe..7747ec1 100644
--- a/Makefile
+++ b/Makefile
@@ -27,12 +27,14 @@
 
 all:
 	@echo "make install - Install into DESTDIR"
+	@echo "make lint    - Run lint tests"
 	@echo "make test    - Run tests"
 	@echo "make kitchen - Run Kitchen CI tests (create, converge, verify)"
 	@echo "make clean   - Cleanup after tests run"
 	@echo "make release-major  - Generate new major release"
 	@echo "make release-minor  - Generate new minor release"
 	@echo "make changelog      - Show changes since last release"
+	@echo "make test-model-validate      - Run salt jsonschema validation"
 
 install:
 	# Formula
@@ -45,9 +47,16 @@
 	[ -d $(DESTDIR)/$(RECLASSDIR)/service/$(FORMULANAME) ] || mkdir -p $(DESTDIR)/$(RECLASSDIR)/service/$(FORMULANAME)
 	cp -a metadata/service/* $(DESTDIR)/$(RECLASSDIR)/service/$(FORMULANAME)
 
+lint:
+	[ ! -d tests ] || (cd tests; ./run_tests.sh lint)
+
 test:
 	[ ! -d tests ] || (cd tests; ./run_tests.sh)
 
+test-model-validate:
+	# TODO make it actually fail
+	[ ! -d $(FORMULANAME)/schemas/ ] || (cd tests; ./run_tests.sh model-validate)
+
 release-major: check-changes
 	@echo "Current version is $(VERSION), new version is $(NEW_MAJOR_VERSION)"
 	@[ $(VERSION_MAJOR) != $(NEW_MAJOR_VERSION) ] || (echo "Major version $(NEW_MAJOR_VERSION) already released, nothing to do. Do you want release-minor?" && exit 1)
diff --git a/openssh/client/init.sls b/openssh/client/init.sls
index 8d03493..ff5702f 100644
--- a/openssh/client/init.sls
+++ b/openssh/client/init.sls
@@ -1,4 +1,4 @@
 include:
-- openssh.client.service
-- openssh.client.private_key
-- openssh.client.known_host
\ No newline at end of file
+  - openssh.client.service
+  - openssh.client.private_key
+  - openssh.client.known_host
diff --git a/openssh/client/known_host.sls b/openssh/client/known_host.sls
index 38950be..8cf4a95 100644
--- a/openssh/client/known_host.sls
+++ b/openssh/client/known_host.sls
@@ -4,13 +4,13 @@
 include:
 - openssh.client.service
 
-{%- for user_name, user in client.get('user', {}).iteritems() %}
+{%- for xxx, user in client.get('user', {}).iteritems() %}
 
 {%- for host in user.get('known_hosts', []) %}
 
-{{ user_name }}_known_hosts_{{ host.name }}:
+{{ user.user.name }}_known_hosts_{{ host.name }}:
   ssh_known_hosts.present:
-  - user: {{ user_name }}
+  - user: {{ user.user.name }}
   - name: {{ host.name }}
   - enc: {{ host.get('type', 'ecdsa') }}
   {%- if host.fingerprint_hash_type is defined %}
diff --git a/openssh/client/private_key.sls b/openssh/client/private_key.sls
index 5f114c9..a5639cc 100644
--- a/openssh/client/private_key.sls
+++ b/openssh/client/private_key.sls
@@ -4,7 +4,7 @@
 include:
 - openssh.client.service
 
-{%- for user_name, user in client.get('user', {}).iteritems() %}
+{%- for xxx, user in client.get('user', {}).iteritems() %}
 
 {%- if user.private_key is defined %}
 
diff --git a/openssh/files/sshd_config b/openssh/files/sshd_config
index 3e6ae5c..95ed4ae 100755
--- a/openssh/files/sshd_config
+++ b/openssh/files/sshd_config
@@ -36,6 +36,7 @@
 # Authentication:
 LoginGraceTime 120
 
+# FIXME: PermitRootLogin its not boolean variable! need to be refactored!
 PermitRootLogin {% if server.get('permit_root_login', False) %}yes{% else %}no{% endif %}
 
 StrictModes yes
diff --git a/openssh/schemas/client.yaml b/openssh/schemas/client.yaml
new file mode 100644
index 0000000..3000b68
--- /dev/null
+++ b/openssh/schemas/client.yaml
@@ -0,0 +1,139 @@
+%YAML 1.1
+---
+"$schema": "http://json-schema.org/draft-06/schema#"
+title: openssh client role
+description: |
+  openssh client (per-user) configurathion
+type: object
+additionalProperties: false
+
+required:
+  - enabled
+  - user
+
+properties:
+  enabled:
+    description: |
+      Enables openssh client configurathion.
+    type: boolean
+  known_hosts:
+    description: List of pre-defined known hosts for ssh access.
+    type: array
+    items:
+      type: object
+      $ref: "#/definitions/_openssh_known_hosts_object"
+    example:
+    - name: repo.domain.com
+      type: rsa
+      fingerprint: dd:fa:e8:68:b1:ea:ea:a0:63:f1:5a:55:48:e1:7e:37
+  alive:
+    description: Configure ServerAlive* option
+    type: object
+    parameters:
+      interval:
+        description: |
+          Configure ServerAliveInterval option.
+          Sets a timeout interval in seconds after which if no data has been received
+          from the server, ssh(1) will send a message through the encrypted channel to
+          request a response from the server
+        type: integer
+        example: 600
+      count:
+        description: |
+          Configure ServerAliveCountMax option
+          Sets the number of server alive messages which may be sent without ssh receiving
+          any messages back from the server.
+        type: integer
+        example: 3
+  user:
+    description: |
+      Dict of openssh user's, to be configured.
+      Private|pub key only should be configured.
+    type: object
+    additionalProperties: false
+    minProperties: 1
+    # Define exact user
+    patternProperties:
+      '^\w+$':
+        $ref: "#/definitions/_openssh_client_user"
+
+definitions:
+  _openssh_client_user:
+    description: |
+      Define exactly one openssh user.Private|pub key configurathion.
+    type: object
+    required:
+      - enabled
+      - user
+    parameters:
+      enabled:
+        description: Enable\disable user
+        type: boolean
+      private_key:
+        description: Define one user private_key
+        type: string
+        example: "-----BEGIN RSA PRIVATE KEY-----MIIEowIBAAKCAQEAxL6/rVgCet..."
+      public_key:
+        description: Define one user public_key
+        type: string
+        example: "ssh-rsa AAAAB3NzaXXXXAAAXXXX"
+      key:
+        description: Define user private_key type
+        type: string
+        example: "rsa"
+      user:
+        description: Define user login data. In scope of openssh - uses only to acquire user homepath
+        additionalProperties: false
+        minProperties: 1
+        type: object
+        patternProperties:
+          '^[a-z][-a-z0-9_]*$': #  man 5 adduser.conf
+            $ref: "#/definitions/_global_useradd_user"
+
+  _openssh_known_hosts_object:
+    description: Define exactly one known_hosts object
+    type: object
+    properties:
+      name:
+        type: string
+        example: repo.domain.com
+      type:
+        type: string
+        example: rsa
+      fingerprint:
+        type: string
+        example: dd:fa:e8:68:b1:ea:ea:a0:63:f1:5a:55:48:e1:7e:37
+
+  _global_useradd_user:
+    description: Define exactly one linux user login data.
+    additionalProperties: false
+    type: object
+    required:
+      - enabled
+      - name
+    properties:
+      enabled:
+        type: boolean
+      home:
+        type: string
+        example: "/home/user123"
+      password:
+        type: string
+        example: "$6$cJ/vINf7$Wof3.L7L1lKqMFAKoTKxESKOZNSNc.K7BkeJNIXY5bETFjbS200njx9j.Y152wfFRoNXs6b3qBEF5Co0uNeyQ0" # r00tme
+      name:
+        type: string
+        example: user123
+      shell:
+        type: string
+        example: "/bin/sh"
+      sudo:
+        type: boolean
+        description: Allow user to use sudo
+      email:
+        type: string
+        example: example@mail.com
+      full_name:
+        type: string
+        example: "Cloud Infrastructure user"
+      uid:
+        type: integer
diff --git a/openssh/schemas/server.yaml b/openssh/schemas/server.yaml
new file mode 100644
index 0000000..7b07859
--- /dev/null
+++ b/openssh/schemas/server.yaml
@@ -0,0 +1,149 @@
+%YAML 1.1
+---
+"$schema": "http://json-schema.org/draft-06/schema#"
+title: openssh server role
+description: |
+  openssh server configurathion
+type: object
+additionalProperties: false
+
+required:
+- enabled
+- user
+
+properties:
+  enabled:
+    description: |
+      Enables openssh server configurathion.
+    type: boolean
+  bind:
+    description: Specifies sshd servcive listen on configurathion.
+    type: object
+    properties:
+      port:
+        description: |
+          Specifies the local addresses sshd should listen on.
+        type: integer
+      address:
+        description: Specifies the port on which the server listens for connections. Multiple options are permitted.
+        type: string
+        example: 127.0.0.1 192.168.1.1
+  password_auth:
+    description: Specifies whether password authentication is allowed.
+    type: boolean
+  permit_root_login:
+    description: |
+      Specifies whether root can log in using ssh.
+      # TODO currently its only boolean option, need to be fixed.
+      # The argument must be ``yes'', ``prohibit-password'',
+      # ``without-password'', ``forced-commands-only'', or ``no''.
+      # The default is ``prohibit-password''.
+    # enum:
+    #  - yes
+    #  - no
+    #  - without-password
+    #  - forced-commands-only
+    #  - prohibit-password
+    type: boolean
+  user:
+    description: |
+      List of openssh user's, to be configured.
+    type: object
+    additionalProperties: false
+    patternProperties:
+      '^[a-z][-a-z0-9_]*$': #  man 5 adduser.conf
+        type: object
+        minProperties: 1
+        additionalProperties: false
+        required:
+          - enabled
+        properties:
+          enabled:
+            type: boolean
+          public_keys:
+            description: List of pub keys for user (> authorized_keys)
+            type: array
+            items:
+              - type: object
+                additionalProperties: false
+                properties:
+                  key:
+                    type: string
+                    description: ssh public key
+                    example: "ssh-rsa AAAAXXX username@example.com"
+            example:
+            - key: "ssh-rsa AAAAXXX1111 username@example.com"
+            - key: "ssh-rsa AAAAXXX2222 username@example.com"
+          user: #  man 5 adduser.conf
+            $ref: "#/definitions/_global_useradd_user"
+
+  alive:
+    description: Configure ClientAlive* option's.
+    type: object
+    parameters:
+      keep:
+        description: Specifies whether the system should send TCP keepalive messages to the other side
+        type: string
+        enum:
+          - yes
+          - no
+      interval:
+        description: |
+          Configure ClientAliveInterval option.
+          Sets a timeout interval in seconds after which if no data has been
+          received from the client, sshd(8) will send a message through the
+          encrypted channel to request a response from the client.
+        type: integer
+        example: 600
+      count:
+        description: |
+          Configure ClientAliveCountMax option
+          Sets the number of client alive messages which may be sent without ssh receiving
+          any messages back from the client.
+        type: integer
+        example: 3
+  force_command:
+    description: |
+      Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present.
+    type: string
+  use_dns:
+    description: |
+      Specifies whether sshd should look up the remote host name, and to
+      check that the resolved host name for the remote IP address maps back to the very same IP address
+    type: boolean
+
+
+definitions:
+  _global_useradd_user:
+    description: Define exactly one linux user login data.
+    additionalProperties: false
+    type: object
+    required:
+      - enabled
+      - name
+    properties:
+      enabled:
+        type: boolean
+      home:
+        type: string
+        example: "/home/user123"
+      password:
+        type: string
+        example: "$6$cJ/vINf7$Wof3.L7L1lKqMFAKoTKxESKOZNSNc.K7BkeJNIXY5bETFjbS200njx9j.Y152wfFRoNXs6b3qBEF5Co0uNeyQ0" # r00tme
+      name:
+        type: string
+        example: user123
+      shell:
+        type: string
+        example: "/bin/sh"
+      sudo:
+        type: boolean
+        description: Allow user to use sudo
+      email:
+        type: string
+        example: example@mail.com
+      full_name:
+        type: string
+        example: "Cloud Infrastructure user"
+      uid:
+        type: integer
diff --git a/openssh/server/public_key.sls b/openssh/server/public_key.sls
index 95b1682..d9fe879 100644
--- a/openssh/server/public_key.sls
+++ b/openssh/server/public_key.sls
@@ -7,8 +7,6 @@
 
 {%- if user.public_keys is defined %}
 
-{%- if user.get('purge', False) %}
-
 {{ user.user.name }}_ssh_dir:
   file.directory:
   - name: {{ user.user.home }}/.ssh
@@ -16,6 +14,8 @@
   - group: {{ user.user.name }}
   - mode: 700
 
+{%- if user.get('purge', False) %}
+
 {{ user.user.name }}_auth_keys:
   file.managed:
   - name: {{ user.user.home }}/.ssh/authorized_keys
@@ -38,6 +38,8 @@
     {%- for public_key in user.public_keys %}
     - {{ public_key.key }}
     {%- endfor %}
+  - require:
+    - file: {{ user.user.name }}_ssh_dir
 
 {%- endif %}
 
diff --git a/tests/pillar/client.sls b/tests/pillar/client.sls
new file mode 100644
index 0000000..bf746d9
--- /dev/null
+++ b/tests/pillar/client.sls
@@ -0,0 +1,27 @@
+linux:
+  system:
+    enabled: true
+    user:
+      testusername: &_user
+        enabled: true
+        name: testusername
+        sudo: true
+        uid: 9999
+        full_name: Test User
+        home: /home/testusername
+openssh:
+  client:
+    enabled: true
+    user:
+      testusername:
+        enabled: true
+        # Include from linux.system.user structure
+        user: *_user
+    known_hosts:
+    - name: repo.domain.com
+      type: rsa
+      fingerprint: dd:fa:e8:68:b1:ea:ea:a0:63:f1:5a:55:48:e1:7e:37
+    alive:
+      interval: 600
+      count: 3
+
diff --git a/tests/pillar/openssh_client.sls b/tests/pillar/openssh_client.sls
deleted file mode 100644
index 7915aae..0000000
--- a/tests/pillar/openssh_client.sls
+++ /dev/null
@@ -1,22 +0,0 @@
-openssh:
-  client:
-    enabled: true
-    user:
-      test:
-        enabled: false
-        name: test
-        user: 
-          enabled: true
-          name: test
-          sudo: true
-          uid: 9999
-          full_name: Test User
-          home: /home/test
-    known_hosts:
-    - name: repo.domain.com
-      type: rsa
-      fingerprint: dd:fa:e8:68:b1:ea:ea:a0:63:f1:5a:55:48:e1:7e:37
-    alive:
-      interval: 600
-      count: 3
-
diff --git a/tests/pillar/openssh_server.sls b/tests/pillar/openssh_server.sls
deleted file mode 100644
index 6f321a7..0000000
--- a/tests/pillar/openssh_server.sls
+++ /dev/null
@@ -1,25 +0,0 @@
-openssh:
-  server:
-    enabled: true
-    use_dns: False
-    user:
-      test:
-        enabled: true
-        name: test
-        user:
-          enabled: true
-          name: test
-          sudo: true
-          uid: 9999
-          full_name: Test User
-          home: /home/test
-    public_keys:
-    - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCts9Ry.........
-    bind:
-      address: 0.0.0.0
-      port: 8000
-    force_command: /usr/bin/toilet
-    alive:
-      keep: no
-      interval: 600
-      # count: 3
diff --git a/tests/pillar/server.sls b/tests/pillar/server.sls
new file mode 100644
index 0000000..ccfcbcb
--- /dev/null
+++ b/tests/pillar/server.sls
@@ -0,0 +1,33 @@
+linux:
+  system:
+    enabled: true
+    user:
+      testusername: &_user
+        enabled: true
+        name: testusername
+        sudo: true
+        uid: 9999
+        full_name: Test User
+        home: /home/testusername
+openssh:
+  server:
+    enabled: true
+    use_dns: yes
+    user:
+      testusername:
+        enabled: true
+        public_keys:
+          -
+            key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCts9Ry......... user@example.com"
+          -
+            key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB667779Ry......... user@example.com"
+        # Include from linux.system.user structure
+        user: *_user
+    bind:
+      address: 0.0.0.0
+      port: 8000
+    force_command: /usr/bin/toilet
+    alive:
+      keep: no
+      interval: 600
+      # count: 3
diff --git a/tests/run_tests.sh b/tests/run_tests.sh
index 4ee4e0f..b4fef32 100755
--- a/tests/run_tests.sh
+++ b/tests/run_tests.sh
@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 
+###
+# Script requirments:
+#  apt-get install -y python-yaml virtualenv git
 set -e
 [ -n "$DEBUG" ] && set -x
 
@@ -14,11 +17,13 @@
 VENV_DIR=${VENV_DIR:-${BUILDDIR}/virtualenv}
 MOCK_BIN_DIR=${MOCK_BIN_DIR:-${CURDIR}/mock_bin}
 DEPSDIR=${BUILDDIR}/deps
+SCHEMARDIR=${SCHEMARDIR:-"${CURDIR}/../${FORMULA_NAME}/schemas/"}
 
 SALT_FILE_DIR=${SALT_FILE_DIR:-${BUILDDIR}/file_root}
 SALT_PILLAR_DIR=${SALT_PILLAR_DIR:-${BUILDDIR}/pillar_root}
 SALT_CONFIG_DIR=${SALT_CONFIG_DIR:-${BUILDDIR}/salt}
 SALT_CACHE_DIR=${SALT_CACHE_DIR:-${SALT_CONFIG_DIR}/cache}
+SALT_CACHE_EXTMODS_DIR=${SALT_CACHE_EXTMODS_DIR:-${SALT_CONFIG_DIR}/cache_master_extmods}
 
 SALT_OPTS="${SALT_OPTS} --retcode-passthrough --local -c ${SALT_CONFIG_DIR} --log-file=/dev/null"
 
@@ -28,11 +33,11 @@
 
 ## Functions
 log_info() {
-    echo "[INFO] $*"
+    echo -e "[INFO] $*"
 }
 
 log_err() {
-    echo "[ERROR] $*" >&2
+    echo -e "[ERROR] $*" >&2
 }
 
 setup_virtualenv() {
@@ -40,6 +45,9 @@
     virtualenv $VENV_DIR
     source ${VENV_DIR}/bin/activate
     pip install salt${PIP_SALT_VERSION}
+    if [[ -f ${CURDIR}/test-requirements.txt ]]; then
+       pip install -r ${CURDIR}/test-requirements.txt
+    fi
 }
 
 setup_mock_bin() {
@@ -65,6 +73,7 @@
     [ ! -d ${SALT_FILE_DIR} ] && mkdir -p ${SALT_FILE_DIR}
     [ ! -d ${SALT_CONFIG_DIR} ] && mkdir -p ${SALT_CONFIG_DIR}
     [ ! -d ${SALT_CACHE_DIR} ] && mkdir -p ${SALT_CACHE_DIR}
+    [ ! -d ${SALT_CACHE_EXTMODS_DIR} ] && mkdir -p ${SALT_CACHE_EXTMODS_DIR}
 
     echo "base:" > ${SALT_FILE_DIR}/top.sls
     for pillar in ${PILLARDIR}/*.sls; do
@@ -76,6 +85,7 @@
     cat << EOF > ${SALT_CONFIG_DIR}/minion
 file_client: local
 cachedir: ${SALT_CACHE_DIR}
+extension_modules:  ${SALT_CACHE_EXTMODS_DIR}
 verify_env: False
 minion_id_caching: False
 
@@ -83,7 +93,6 @@
   base:
   - ${SALT_FILE_DIR}
   - ${CURDIR}/..
-  - /usr/share/salt-formulas/env
 
 pillar_roots:
   base:
@@ -93,13 +102,13 @@
 }
 
 fetch_dependency() {
+    # example: fetch_dependency "linux:https://github.com/salt-formulas/salt-formula-linux"
     dep_name="$(echo $1|cut -d : -f 1)"
     dep_source="$(echo $1|cut -d : -f 2-)"
     dep_root="${DEPSDIR}/$(basename $dep_source .git)"
     dep_metadata="${dep_root}/metadata.yml"
 
-    [ -d /usr/share/salt-formulas/env/${dep_name} ] && log_info "Dependency $dep_name already present in system-wide salt env" && return 0
-    [ -d $dep_root ] && log_info "Dependency $dep_name already fetched" && return 0
+    [ -d $dep_root ] && { log_info "Dependency $dep_name already fetched"; return 0; }
 
     log_info "Fetching dependency $dep_name"
     [ ! -d ${DEPSDIR} ] && mkdir -p ${DEPSDIR}
@@ -109,6 +118,19 @@
     METADATA="${dep_metadata}" install_dependencies
 }
 
+link_modules(){
+    # Link modules *.py files to temporary salt-root
+    local SALT_ROOT=${1:-$SALT_FILE_DIR}
+    local SALT_ENV=${2:-$DEPSDIR}
+
+    mkdir -p "${SALT_ROOT}/_modules/"
+    # from git, development versions
+    find ${SALT_ENV} -maxdepth 3 -mindepth 3 -path '*_modules*' -iname "*.py" -type f -print0 | while read -d $'\0' file; do
+      ln -fs $(readlink -e ${file}) "$SALT_ROOT"/_modules/$(basename ${file}) ;
+    done
+    salt_run saltutil.sync_all
+}
+
 install_dependencies() {
     grep -E "^dependencies:" ${METADATA} >/dev/null || return 0
     (python - | while read dep; do fetch_dependency "$dep"; done) << EOF
@@ -131,13 +153,24 @@
 prepare() {
     [ -d ${BUILDDIR} ] && mkdir -p ${BUILDDIR}
 
-    which salt-call || setup_virtualenv
+    [[ ! -f "${VENV_DIR}/bin/activate" ]] && setup_virtualenv
     setup_mock_bin
     setup_pillar
     setup_salt
     install_dependencies
 }
 
+lint_releasenotes() {
+    [[ ! -f "${VENV_DIR}/bin/activate" ]] && setup_virtualenv
+    source ${VENV_DIR}/bin/activate
+    reno lint ${CURDIR}/../
+}
+
+lint() {
+#    lint_releasenotes
+    log_err "TODO: lint_releasenotes"
+}
+
 run() {
     for pillar in ${PILLARDIR}/*.sls; do
         grep ${FORMULA_NAME}: ${pillar} &>/dev/null || continue
@@ -152,7 +185,7 @@
             meta_name=$(basename ${meta})
             echo "Checking meta ${meta_name} ..."
             salt_run --out=quiet --id=${state_name} cp.get_template ${meta} ${SALT_CACHE_DIR}/${meta_name} \
-              || (log_err "Failed to render meta ${meta} using pillar ${FORMULA_NAME}.${state_name}"; exit 1)
+              || { log_err "Failed to render meta ${meta} using pillar ${FORMULA_NAME}.${state_name}"; exit 1; }
             cat ${SALT_CACHE_DIR}/${meta_name}
         done
     done
@@ -161,7 +194,24 @@
 real_run() {
     for pillar in ${PILLARDIR}/*.sls; do
         state_name=$(basename ${pillar%.sls})
-        salt_run --id=${state_name} state.sls ${FORMULA_NAME} || (log_err "Execution of ${FORMULA_NAME}.${state_name} failed"; exit 1)
+        salt_run --id=${state_name} state.sls ${FORMULA_NAME} || { log_err "Execution of ${FORMULA_NAME}.${state_name} failed"; exit 1; }
+    done
+}
+
+run_model_validate(){
+    [[ -d ${SCHEMARDIR} ]] || { log_err "${SCHEMARDIR} not found!"; return 1; }
+    # model validator require py modules
+    fetch_dependency "salt:https://github.com/salt-formulas/salt-formula-salt"
+    link_modules
+    # Sync, afer dep's update
+    salt_run saltutil.clear_cache; salt_run saltutil.refresh_pillar; salt_run saltutil.sync_all
+    # Rendered Example:
+    # salt-call --local -c /test1/maas/tests/build/salt --id=maas_cluster modelschema.model_validate maas cluster
+    for role in ${SCHEMARDIR}/*.yaml; do
+        state_name=$(basename "${role%*.yaml}")
+        minion_id="${state_name}"
+        log_info "Processing model_validate for:${FORMULA_NAME} ${state_name} ${minion_id}"
+        salt_run --id=${minion_id} modelschema.model_validate ${FORMULA_NAME} ${state_name} || { log_err "Execution of ${FORMULA_NAME}.${state_name} failed"; exit 1 ; }
     done
 }
 
@@ -187,14 +237,23 @@
     prepare)
         prepare
         ;;
+    lint)
+        lint
+        ;;
     run)
         run
         ;;
     real-run)
         real_run
         ;;
+    model-validate)
+       prepare
+       run_model_validate
+        ;;
     *)
         prepare
+#        lint
         run
+        run_model_validate
         ;;
 esac
diff --git a/tests/test-requirements.txt b/tests/test-requirements.txt
new file mode 100644
index 0000000..a0f561a
--- /dev/null
+++ b/tests/test-requirements.txt
@@ -0,0 +1,2 @@
+jsonschema
+reno