ContextOS 0.1.0-alpha.17

ContextOS 0.1.0-alpha.17

The seventeenth alpha of ContextOS. It adds runtime controls the 2025–26 research on
securing agents ranks highest and a gateway can enforce on its own: information-flow
labels, circuit breakers that trip the kill switch, a trusted action monitor, and a
review-time floor for approvals. Every one is off until it is configured. It also
meters model calls made through LiteLLM, and gives Tower an approvals inbox, a
revocations view and model spend.

What changed since 0.1.0-alpha.16

Runtime guards (off unless configured; see the GUIDE and threat-model entries
T41–T44)

• [guards.information_flow]: each run carries an integrity label and a
  classification label. Both rise with the tool output its agent receives.
  Capability manifests declare flow.output_integrity,
  flow.output_classification and flow.egress_ceiling. Undeclared output counts
  as untrusted INTERNAL. Three rules apply:

  • An effect after untrusted input needs an approval of the exact action.
  • Egress above a capability's ceiling is denied.
  • The "rule of two" covers untrusted input combined with CONFIDENTIAL data and
    egress or an external effect.

  Labels pass to delegated children and back. mode = "observe" only audits
  (information_flow_decision).

• [[guards.circuit_breakers]] counts effects or refusals per agent, admitting
  principal or tenant, in a sliding window. At its threshold, a breaker refuses the
  calls it governs (circuit_open). With trip = "revoke", it also revokes the
  target in the kill switch (by: circuit_breaker:<id>), so the target stays stopped
  until an operator restores it. Each trip is audited (circuit_breaker_tripped). The
  new alert ContextOSCircuitBreakerOpen has a runbook entry.

• [providers.action_monitor] with [guards.action_monitor]: your monitor model
  scores every effectful or data-sending call before it is sent. It sees the action
  binding and the run's recent calls.

  • A score at ask_at needs an approval of the exact action.
  • A score at deny_at is denied.
  • A run whose summed suspicion reaches run_budget needs approvals from then on.
  • An unavailable monitor gets on_unavailable, which defaults to ask.

• [guards.approval_review] sets min_review_seconds. An approval decided sooner
  than that after the gateway requested it is not used (approval_review_too_fast,
  obligation review_again). The audit records the seconds measured. Scope the floor
  by capability or amount, as with step-up.

• Each run pins the runtime guards' policy it was admitted under
  (guard_policy_ref), so its decisions cite the configuration that decided them.

Model metering

• contextos-litellm (integrations/litellm) is a LiteLLM proxy callback. It claims
  each model call's reservation before forwarding it, and caps the call's output
  tokens to the reservation. It then settles the usage the provider reported, off the
  response path. It fails closed when contextosd is unreachable.
• POST /v1/runs/{run_id}/usage/claim (meter scope) claims a reservation for the
  one call a metering gateway is about to forward, across replicas. usage/settle
  accepts model.
• New audit entries record usage: usage_refused, usage_claimed and
  usage_settled.

Tower

• An approvals inbox lists open escalations across runtimes in one queue. Risk
  reviewers and operators can resolve them from it.
• Runtime sources can be managed from the console (probe, add, pause, resume, retry
  verification, reload keys, remove), with a reason in Tower's journal for each
  change. Source keys can be read from mounted secret files.
• A Revocations view shows every revocation in force across the fleet. It reconciles
  each runtime's live list against its verified audit chain.
• Restoring a revocation takes two people: one operator requests the restore and a
  second approves it.
• Model spend per agent, team and model keeps measured usage and self-reported usage
  apart. New findings flag uncovered and unmetered model spend.

Documentation

• COMPLIANCE.md maps ContextOS controls to these frameworks, citing
  the threat-model entries whose tests are the evidence:
  • the OWASP Top 10 for Agentic Applications (2026);
  • EU AI Act Articles 9, 12, 14, 15 and 26;
  • the Singapore agentic AI framework;
  • the NIST AI RMF;
  • ISO/IEC 42001.
• The design and its sources are in
  design/agentic-controls.md and
  research/2026-11-07-agent-governance-sources.md.

The changelog
lists every change.

Upgrading from 0.1.0-alpha.16

• Tower restores need two operators by default. [governance] two_person_restore
  now defaults to true, so POST /api/fleet/restore answers
  409 two_person_required. Set it to false to keep one-operator restores.
• Turn the new guards on only after every replica runs alpha.17. An alpha.16
  replica does not enforce them.
• Runs in flight when a guard is first turned on are not pinned to it. For such a
  run, a call the information-flow guard or the action monitor would send for approval
  is refused instead (flow_policy_unpinned, monitor_policy_unpinned). Turn guards
  on between workloads, or expect these refusals until the runs finish.
• Startup notes every capability without flow labels while the
  information-flow guard is on. Its output counts as untrusted INTERNAL, and it may
  send out at most INTERNAL data. Label capabilities before turning the guard on.
• The store holds new document kinds and needs no migration. No configuration key,
  API or storage format is removed.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl. To verify an archive's checksum and
provenance, follow the
alpha.12 notes
with v0.1.0-alpha.17 as the tag.

The container image is ghcr.io/contextosai/contextosd:0.1.0-alpha.17 for
linux/amd64 and linux/arm64. It is signed and carries build provenance.

Install the clients with pip install --pre contextos-client and
npm install contextos-client. contextos-litellm is not on PyPI yet. Install it
from this tag:
pip install "contextos-litellm @ git+https://github.com/contextosai/ContextOS@v0.1.0-alpha.17#subdirectory=integrations/litellm".

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.

ContextOS 0.1.0-alpha.16

ContextOS 0.1.0-alpha.16

The sixteenth alpha of ContextOS. It hardens what alpha.15 added for production:
provider failover now survives an endpoint that hangs, and the built-in TLS server
defends itself against slow and abusive clients without a proxy in front.

What changed since 0.1.0-alpha.15

Providers

• A capability's timeout_ms now covers every endpoint attempt. A read-only call
  gives each attempt an equal share of what remains, so a primary that accepts the
  request and never answers is given up in time for a fallback to answer. Before, the
  whole call timed out as unknown. Effectful calls are unchanged: a hang stays
  unknown and is never resent.
• Any 5xx answer counts toward outlier ejection, so a replica that keeps answering
  500 is ejected. A 500 still moves no call on: the endpoint answered, and the
  error is as often the tool's own.
• A fallback endpoint on another origin than endpoint is logged as a warning at
  startup. Every listed endpoint is sent the provider credential, so list only
  endpoints in the provider's trust domain.

Serving

• [server.tls] max_connections (default 10000) caps open connections; further
  clients wait in the accept queue.
• [server.tls] header_timeout_secs (default 30) disconnects an HTTP/1.1 client that
  trickles its headers, and closes a connection with no request in progress for that
  long, over either protocol. A slow request or a streaming response is never cut off.
• HTTP/2 connections allow 200 concurrent requests and are pinged every 30 seconds,
  then closed if a ping goes unanswered for 20.
• A failed accept (out of file descriptors, for one) backs off from 5 ms to one second
  instead of spinning at full CPU.
• contextosd --mcp-stdio forwards initialize and every notification in order, and
  bounds each stdin line at 16 MiB while reading it rather than after buffering it.

Observability

• A governed call that fails on infrastructure (store, audit chain, shared guarantee,
  manifest or outcome contract) now leaves a contextos::access line with
  status="error" and the failing dependency as its reason, so dashboards that count
  access lines count failed calls too.

Documentation

• Pack-binding claim leases assume replicas with synchronized clocks (NTP).
• The release checklist now includes moving contextosai.com to the release.

The changelog
lists every change.

Upgrading from 0.1.0-alpha.15

• Idle TLS connections close after 30 seconds when [server.tls] is configured.
  Clients that pool connections reconnect transparently; set header_timeout_secs
  higher if a client keeps idle connections open longer and does not retry.
• Read-only calls with fallbacks give the primary a share of timeout_ms, not all
  of it (half with one fallback). Raise timeout_ms if a healthy primary routinely
  answers in more than that share.
• Replicas answering 500 can now be ejected. Ejected endpoints are still tried,
  last, so no call is refused without an attempt.
• Log volume: calls that fail on infrastructure add one access line each.
• No configuration key, API or storage format is removed.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl. Verify an archive's checksum and provenance
as in the alpha.12 notes,
with v0.1.0-alpha.16 as the tag. The container image is
ghcr.io/contextosai/contextosd:0.1.0-alpha.16 for linux/amd64 and linux/arm64,
signed and with build provenance. The clients are pip install --pre contextos-client
and npm install contextos-client.

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.

ContextOS 0.1.0-alpha.15

ContextOS 0.1.0-alpha.15

The fifteenth alpha of ContextOS. It is about running the gateway in production:
serving TLS and mutual TLS without a proxy, failing over between provider replicas
without ever repeating an effect, tracing and logging every governed call, and
hardening the MCP endpoint.

What changed since 0.1.0-alpha.14

Serving

• [server.tls] serves HTTPS without a terminating proxy, with HTTP/2 by ALPN.
  client_ca_path requires client certificates (mutual TLS), so only workloads
  holding one, such as SPIFFE X.509 SVIDs, can connect. Rotated certificate files are
  picked up without a restart; a rotation that fails to load keeps the previous
  certificate. --check-config loads the files.
• The MCP endpoint refuses browser origins other than public_url's and
  [server] allowed_origins (403 origin_not_allowed), so a web page cannot reach it
  through DNS rebinding. Callers that send no Origin are unaffected.
• contextosd --mcp-stdio <url> connects MCP hosts that only launch local (stdio)
  servers to a run's MCP endpoint, with the token in CONTEXTOS_TOKEN and the
  executor generation in CONTEXTOS_EXECUTOR_GENERATION.

Providers

• [[adapters]] fallback_endpoints lists replicas of a provider. A call moves to the
  next endpoint only when its request never left, or, for read-only capabilities,
  after a lost response or a 502/503/504. An effect that may have been delivered is
  never sent again. Three consecutive failures eject an endpoint for 30 seconds,
  backing off to five minutes, and ejected endpoints are tried last.
• GUIDE.md now lists what happens when each dependency fails. Decision services fail
  closed with a reason code that names them; there is no fail-open switch.

Observability

• Every governed call, through the server or embedded, runs in one
  contextos.dispatch span, exported as execute_tool <capability> with the
  OpenTelemetry GenAI attributes (gen_ai.operation.name, gen_ai.tool.name,
  gen_ai.tool.call.id), the outcome, the stage the pipeline stopped in
  (contextos.stage), each stage's duration (contextos.stages) and error.type on
  a refusal. Before this release, calls through the server had no span at all.
• An access log: one JSON line per governed call on target contextos::access, on by
  default at info. RUST_LOG=info,contextos::access=off turns it off.

Configuration

• docs/CONFIG.md lists every configuration key with its type, default
  and meaning, and docs/METRICS.md every metric. Both are generated
  from the code and checked by a test.
• contextosd --config-schema prints the configuration's JSON Schema, committed as
  deploy/contextosd-config.schema.json. The example configuration names it in a
  #:schema comment, so TOML editors complete and check keys.

Supply chain

• The container image is published for linux/amd64 and linux/arm64 under one tag.
  Each architecture is built natively and smoke-tested before the index is tagged,
  signed and attested.
• Coverage-guided fuzz targets for the kernel's entry points, JsonLogic, canonical JSON
  and upstream MCP responses run weekly and on changes to that code.
• Every GitHub Action is pinned to a commit SHA.

The changelog
lists every change.

Upgrading from 0.1.0-alpha.14

• MCP clients must send a supported MCP-Protocol-Version, or none. An
  unsupported version is now refused with 400 instead of being ignored. A JSON-RPC
  request without an id is refused with 400; only notifications/* may omit it.
• Browser-based MCP clients on an origin other than public_url's must be listed
  in [server] allowed_origins.
• Trace queries on contextos.continue stop matching. A continuation is now a
  contextos.dispatch span with contextos.continuation = true.
• Log volume grows by one line per governed call (the access log). Set
  RUST_LOG=info,contextos::access=off to keep the previous volume.
• No configuration key, API or storage format is removed. TLS and fallback endpoints
  are off until configured.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl. Verify an archive's checksum and provenance
as in the alpha.12 notes,
with v0.1.0-alpha.15 as the tag. The container image is
ghcr.io/contextosai/contextosd:0.1.0-alpha.15 for linux/amd64 and linux/arm64,
signed and with build provenance. The clients are pip install --pre contextos-client
and npm install contextos-client.

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.

ContextOS 0.1.0-alpha.14

ContextOS 0.1.0-alpha.14

The fourteenth alpha of ContextOS. It is about authoring and operating Context Packs:
testing a pack before release, seeing what it lets a principal do, building it from
shared rules, publishing new versions while the server runs, and delivering the audit
chain to a SIEM.

What changed since 0.1.0-alpha.13

Authoring packs

• ctx test runs pack test suites offline through admission's own compiler and policy
  composition: a base case, a JSON merge patch per test, and the expected verdict,
  rules, obligations, capabilities and evidence gates. It exits 1 on any failure and
  can write JUnit XML.
• ctx plan and POST /v1/plan (compile scope) report what a pack lets one
  principal do for an intent before any request exists. Each rule applies always, or
  when or unless a residual condition over request.* holds. The residuals come from
  an exact partial evaluator (contextos_policy::partial_apply).
• ctx build assembles a pack from a pack source: a base, a JSON merge patch and
  imports of rule libraries, each optionally limited to some bundles, given a priority
  or scoped to one intent. --check fails when a committed pack no longer matches its
  sources.
• ctx inspect summarises a pack for review and lists problems such as names that do
  not resolve; ctx repl tries a pack on one case interactively.
• skills/contextos-pack-authoring is an agent skill for writing and changing packs,
  with scripts/check_pack.sh.

Running packs

• POST /v1/runs/{run_id}/tool-calls/check (dispatch scope) governs a tool call as
  dispatch would and stops before anything is redeemed, reserved, claimed or sent. One
  tool_call_check audit entry records each check. Clients: check_tool_call /
  checkToolCall.
• pack_dirs, pack_reload_secs and POST /v1/packs/reload (control scope) add
  pack versions while the server runs. A reload only adds: a removed file does not
  unload its version, and a pack for a tenant without a startup pack is refused.
• A pack reference now names one content across restarts. The first load of a
  reference records pack_loaded and binds the reference to its digest in the store
  before the pack serves traffic. A later load with other content is refused on reload
  and stops the server at startup.
• The Helm chart's packSync keeps a pack directory current from git (git-sync as an
  init container and a sidecar). deploy/README.md has the recipe.

Audit

• [[audit_sinks]] delivers every tenant's audit chain to a SIEM or archive: in order,
  in HMAC-signed batches over HTTPS, at least once and never skipping an entry. Fields
  named by mask become keyed HMAC tokens, so equal values still correlate.
  ctx audit-verify checks a masked entry's spine and signature and reports its
  payload as unverified.

Also

• llms.txt: an index of the docs, API, schemas, clients and examples for LLMs and
  agents.
• ctx build reports a malformed library rule as a usage error instead of panicking;
  ctx plan caps the intent at 256 bytes, as POST /v1/plan does.
• Dependency updates, including napi 3.16.1, jsonschema 0.60.2 and react-router 8.5.1.

The changelog
lists every change.

Upgrading from 0.1.0-alpha.13

• Packs are bound to their digest on first start. The first start of alpha.14
  records one pack_loaded entry per loaded pack in its tenant's audit chain and binds
  each reference to its content. From then on, a start whose pack file has other
  content under the same reference fails with context pack <ref>: the reference is bound to sha256:…; publish changes as a new version. If you edit packs in place,
  change pack_meta.pack_version with every edit. Bindings outlast a restart only
  with the postgres store.
• Webhook cursors move. Escalation webhook cursors are stored under a new document
  kind. A cursor kept by alpha.13 is carried over the first time it is used, so no
  escalation event is skipped or sent again. No action is needed.
• No API or storage format is removed or changed incompatibly.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl. Verify an archive's checksum and provenance
as in the alpha.12 notes,
with v0.1.0-alpha.14 as the tag. The container image is
ghcr.io/contextosai/contextosd:0.1.0-alpha.14, signed and with build provenance.
The clients are pip install --pre contextos-client and npm install contextos-client.

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.

ContextOS 0.1.0-alpha.13

ContextOS 0.1.0-alpha.13

The thirteenth alpha of ContextOS. It changes one thing: the Python client is
published on PyPI as contextos-client.

pip install --pre contextos-client

The module is still import contextos. 0.1.0-alpha.12 meant to publish the package
as contextos, but PyPI refuses that name as too similar to an existing, unrelated
project, so alpha.12 reached npm only. The Python package now takes the npm package's
name, so both registries use contextos-client. The release's wheels are named
contextos_client-*.whl.

Nothing else changed. Read the
0.1.0-alpha.12 notes
for what changed since alpha.11 and how to upgrade. If you installed an alpha.12 wheel
from its release assets, uninstall it (pip uninstall contextos) before installing
contextos-client: both provide the contextos module.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl. Verify an archive's checksum and provenance
as in the alpha.12 notes,
with v0.1.0-alpha.13 as the tag. The container image is
ghcr.io/contextosai/contextosd:0.1.0-alpha.13, signed and with build provenance.

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.

ContextOS 0.1.0-alpha.12

ContextOS 0.1.0-alpha.12

The twelfth alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects, and now
of whether the intended outcome happened.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.11

• Installable clients. pip install --pre contextos and
  npm install contextos-client install the HTTP clients from the public registries.
  The release also attaches the wheels (Linux x86-64 and ARM64 on glibc 2.28+ and
  macOS arm64 with the in-process kernel, plus a pure-Python wheel for every other
  platform) and the npm tarball, all with build provenance. Before its first
  admission each client reads the server's runtime_version and api_version from
  GET /v1/deployment: another API generation raises IncompatibleServer, another
  release warns.
• Draft a manifest from an MCP tool. ctx init-tool --mcp tools.json --tool <name> --adapter <id> copies the schemas and upstream pin and leaves every authority
  decision as a REVIEW: placeholder; nothing loads until each is answered.
• Evidence that cannot be self-asserted. With [guards] evidence = "strict",
  gated facts must arrive as evidence entries carrying a JWS from an
  [[evidence_issuers]] issuer. contextosd sets their integrity and freshness from the
  signature and its own clock, and [[evidence_subjects]] binds each requirement to
  the entity it concerns, so an authentic attestation about another order no longer
  satisfies it. Strict is the default under the enterprise profile.
• One ledger per real resource. resource_canonicalizer (exact,
  ascii_casefold, or provider, asking your identity service) makes aliases of one
  order share one ledger and one limit.
• Exposure from before ContextOS. POST /v1/guarantees/{id}/imports imports prior
  or outside spending into a guarantee's ledgers, idempotently and audited. An import
  that takes a resource past its limit is kept, the resource refuses new effects and
  ContextOSResourceOverLimit fires. examples/ops/import_exposure.py uploads a CSV.
• Aged holds reach their business owner. owner_route and owner_after_seconds
  on a guarantee deliver each hold older than the threshold once, with its diagnosis
  and next safe step, to that owner's webhook.
• Agents confined to the boundary. The Helm chart's agentEgress lets agent pods
  reach contextosd, DNS and a model gateway only, so with provider credentials only in
  contextosd's Secret it is the only path to the systems agents act on
  (egress recipe).
• Outcome contracts. A capability manifest may declare outcome: {witness, postcondition, binds, within_seconds, on_missed}. Once its effect is applied, the
  run cannot complete and decisions citing it cannot close until a separately
  credentialed witness attests the postcondition for the action's resource, amount
  and, with binds = "effect", the provider's receipt. A missed deadline escalates
  once. Outcome state is derived from the operation ledger and fenced to the attempt
  that may apply the effect, so crashes and retries neither lose an obligation nor
  close it early. examples/outcome-witness is a synthetic refund pilot.
• Keycloak. [[oidc]] claims are paths, keys can be discovered from the issuer,
  tenants can come from Keycloak organizations, and [oidc.delegation] accepts RFC
  8693 delegated tokens. [guards] user_binding checks a run's user against the token
  (guide,
  examples/keycloak, run in CI against Keycloak 26.8).

The full list is in the changelog.

Upgrading from 0.1.0-alpha.11

The schema is unchanged; no migration is needed. Check these before upgrading:

• Strict evidence (enterprise profile). With contextos.enterprise, contextosd
  refuses to start with evidence = "caller", and a run whose request.input.context
  names a gated evidence item is refused (422 evidence_in_request_context). Configure
  [[evidence_issuers]], have them sign the facts your packs gate, and send them as
  deps.evidence entries with an attestation. Run contextosd --check-config: it
  warns about strict evidence without issuers, gated requirements without an
  [[evidence_subjects]] binding, and rules that read a gated name from
  request.context (such a rule never matches under strict evidence).
• Node kernel package. The unpublished Node kernel package in bindings/node is
  named contextos-kernel; import the HTTP client as contextos-client.
• Client version check. Clients from this release warn when the server reports
  another release, and older servers report none. Upgrade servers and clients
  together, or pass check_server=False (Python) / checkServer: false (Node).

New scopes: exposure:import and outcome:report. Rust embedders: configuration
structs gain the new fields above.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing, conservative reconciliation of unknown outcomes and
  witnessed outcome contracts.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, manifest drafting, development attestation,
  audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, outcome witnesses, Keycloak, agent loops,
  peers, metering and Tower.
• The contextos wheels and contextos-client npm tarball, also published to PyPI
  and npm. crates.io stays unpublished.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.12-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.12/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.12/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.12
tar xzf "$asset"
cd contextos-v0.1.0-alpha.12-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/outcome-witness/run.sh, ./examples/support-refund/run.sh and
./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.12 (also tagged v0.1.0-alpha.12), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated...

ContextOS 0.1.0-alpha.11

ContextOS 0.1.0-alpha.11

The eleventh alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

This is the first published release since 0.1.0-alpha.5. 0.1.0-alpha.6 through
alpha.10 were tagged but never published as releases; read the
alpha.6 notes
too if you are upgrading from alpha.5. alpha.7's archives lacked files its README
names, alpha.8's container exited under the Helm chart, review of alpha.9 found a
pinned capability on a non-MCP adapter refused forever and one tenant able to crowd
others out of Tower's fleet view, and alpha.10 could not reach providers behind a
private CA. All are fixed here.

What changed since 0.1.0-alpha.6

• Services behind your own CA. Production requires HTTPS for providers and
  adapters, and every client trusted only the public roots built into the binary, so
  providers, the KMS, OIDC issuers or internal APIs behind an organisation's own CA
  were unreachable. CONTEXTOS_CA_BUNDLE names a PEM file of CA certificates that
  every outgoing connection trusts too, from contextosd and towerd alike; a file
  without certificates stops startup, and --check-config reports it.
• Kubernetes, as deployed. The Helm chart migrates the schema as its owner before
  every install and upgrade (migration.enabled), so the server's role needs no DDL
  rights, and takes sidecars and extra mounts and environment (extraContainers,
  extraVolumes, extraVolumeMounts, extraEnv). CI installs it on a kind cluster in
  production mode: PostgreSQL with an owner and a least-privilege role, providers
  over HTTPS behind a generated CA, a run admitted and a refund dispatched, the kill
  switch, audit verification, a rolling restart and an upgrade.
• Tower caps its whole fleet at 500,000 agents behind the per-tenant bound.
• From clone to your own governed agent. ./examples/dev-server.sh runs
  contextosd locally with the quickstart's pack and synthetic providers and prints
  the URL and token to point your agent at. The README's "Govern your own agent"
  section, a glossary and
  install notes for the Python client cover the rest.
  contextosd --help exists, and --check-config lists every missing environment
  variable at once.
• Deployable as documented. The container image starts under the Helm chart (the
  chart's arguments no longer add a second --config). A least-privilege database
  role can run the server: contextosd --migrate <config> creates or upgrades the
  schema as its owner, and a current schema needs no DDL at start.
• For operators. The guide covers backup and restore (and what to do before serving
  after a restore), the production refusals and the settings behind them, and database
  grants. examples/ops/unresolved.py lists effects awaiting reconciliation with the
  call for each. The Helm chart README has a worked values file. --check-config warns
  when no caller can authenticate, when a capability's adapter is not configured, and
  when production signs the audit chain with a seed rather than a KMS.
• Review fixes. Startup refuses an upstream pin outside MCP adapters (it could
  never be checked); unverified pinned tools are re-checked every 15 seconds; Tower
  bounds agents per tenant; migrations run under an advisory lock, one replica at a
  time; --check-config names every pack where a run could declare one intent to
  avoid another's rules. New informational alerts track agent-binding and
  pack-intent mismatches while either guard runs in observe.
• Intent-scoped rules can no longer be stepped around. A policy rule scoped to an
  intent applied only to runs declaring that intent, and the caller declares it, so a
  run declaring another intent got the pack's tools without the rule. A run's intent
  must now be one its pack's rules name ([guards] pack_intents): refused with the
  enterprise profile, counted and recorded otherwise.
• Upstream drift checks survive restarts. A capability pinned to its upstream MCP
  tool refuses calls (upstream_tool_unverified, retryable) until the replica has
  checked it once, including when the provider is unreachable at startup.
• Step-up thresholds per currency. amount_at_least names a currency; an amount
  in a currency without a threshold always needs step-up.
• Hardening from review. A token endpoint's oversized expires_in no longer
  crashes the runtime; the evidence endpoint refuses a looping archive chain; feedback
  closures accept only identifier-shaped evidence references; Tower's fleet model is
  bounded in memory as documented.
• Scope, written down. SCOPE.md now covers which intent a run
  serves and how evidence gates are satisfied. Spec proposals 0006 (intent-scoped
  restrictions) and 0007 (resume after delegated children close) are drafts for the
  specification.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.6

From 0.1.0-alpha.5, first apply the
alpha.6 upgrade notes
(agent binding and upstream pins under the enterprise profile), then these.

The schema gains a version table (contextos_schema_version). A server whose database
role owns the schema migrates on start, as before. With a least-privilege role, run
contextosd --migrate <config> as the owner first, then grant the runtime role
SELECT on contextos_schema_version (GUIDE section 12, Store). The image's
entrypoint is now the bare contextosd binary with --config /etc/contextos/contextosd.toml as its default arguments: if you run it with your own
arguments, pass --config yourself. Two more changes can need configuration:

• Pack intents (enterprise profile). With contextos.enterprise, admission refuses
  a run whose intent its pack's rules do not name (422 intent_not_governed). Without
  the profile, such runs are admitted and counted in
  contextos_pack_intent_mismatches_total. Before upgrading an enterprise deployment,
  set [guards] pack_intents = "observe", watch the counter reach zero (or give each
  intent you serve its own rules), then remove the override.
• Step-up thresholds. [guards.approval_step_up] amount_at_least = 100000 no
  longer parses; write amount_at_least = [{ currency = "USD", minor_units = 100000 }].

run_admitted gains pack_intent, and a delegated run's agent_binding gains
named_by_credential. Rust embedders: GuardsConfig gains pack_intents, and
StepUpPolicy::amount_at_least is a Vec<AmountThreshold>.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-...

ContextOS 0.1.0-alpha.5

ContextOS 0.1.0-alpha.5

The fifth alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.4

• Upgrade a capability while its operations are open. retired_capabilities
  lists the manifests of versions an upgrade replaced. Operations claimed under a
  retired version are still reconciled, attested and recorded with it; it is never
  dispatched. Before, an upgrade left those operations refused as
  capability_not_pinned, holding their budget and shared capacity.
• Resources are no longer limited to 1,024 operations. A settled receipt is
  archived an hour after it is first seen settled, and its committed amount stays in
  the resource's total. The 1,024 cap now bounds receipts live at once; held receipts
  are never archived. Resource views add archived_receipts.
• Independent reconciliation. The principal that admitted a run can no longer
  assert its own effect not_applied or partial.
• Fixes. Release builds unwind on panic again, so one request's panic no longer
  ends the process. The Python client and Tower's AI assistant client no longer
  follow redirects that resent their credentials. --check-config and startup warn
  about effectful capabilities that task amount and resource limits cannot bound.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.4

No storage migration is needed; existing shared-guarantee ledgers are read as they
are. Two changes can break existing setups:

• Reconcile with an independent principal. A run's admitting principal asserting
  not_applied or partial now gets 403 reconcile_not_independent. It may still
  query the provider or assert confirmed. Give on-call or reconciliation automation
  its own key with the reconcile scope; a principal that did not admit the run sends
  no executor generation. The Python client adds Client.reconcile(run_id, operation_id, *, outcome, evidence_ref).
• Python client transport. Redirects are no longer followed, and a plain http
  URL to a non-loopback host is refused unless you pass allow_http=True (to
  Client or AsyncClient).

Also:

• When you upgrade a capability, move the old manifest to retired_capabilities
  instead of deleting it until its operations are settled. See "Upgrading a
  capability with operations open" in the deployment guide.
• Startup may now log warnings for effectful capabilities that declare no amount or
  no resource_pointers; they do not stop it.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.5-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.5/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.5/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.5
tar xzf "$asset"
cd contextos-v0.1.0-alpha.5-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.5 (also tagged v0.1.0-alpha.5), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource holds at most 1,024 receipts at once; a settled receipt leaves an hour
  after it is first seen settled, so sustained traffic above roughly 1,024 operations
  an hour on one resource is refused until older receipts age out. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence or released by an attestation of absence, which is a principal's audited
  claim, not proof. The peer board is limited to 256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.

ContextOS 0.1.0-alpha.4

ContextOS 0.1.0-alpha.4

The fourth alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.3

• Release holds left by a dead executor. An attempt whose dispatch started and
  recorded no fact used to hold its budget, task-limit charge and shared capacity
  forever. POST /v1/runs/{run_id}/operations/{operation_id}/attest-absence lets a
  principal holding the new attest scope (never with admit or dispatch) state,
  citing the provider's records, that the effect did not apply. It is accepted only
  once those records were checked through the attempt's start plus the capability's
  timeout plus 300 seconds; the run's executor is fenced and effect_absence_attested
  is signed before anything is released.
• Runs belong to the principal that admitted them. Another principal in the
  tenant that learns a run id can no longer drive the run.
• MCP completion contracts. In production, an effectful MCP capability must
  declare recovery.completion; a result reporting pending or failed is no
  longer counted as a confirmed effect.
• Fixes. A dispatch that stalls more than 120 seconds between its claim and the
  provider call sends nothing, so an attestation cannot race a paused dispatcher. A
  guarded dispatch whose shared-guarantee link is missing is withheld instead of sent
  unmarked. The Tower console sets nosniff and no-store itself. Dependency
  updates for Tower, the framework examples and CI actions.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.3

No storage migration is needed. Two changes can break existing setups:

• One principal per agent service. Tool calls, status, takeover,
  complete/fail/cancel, decisions, usage reservation, checkpoints, memory, peer work,
  findings, compensation and delegation from a parent answer 404 run_not_found to
  any principal other than the one that admitted the run. If several services share
  one principal, nothing changes; if one service admits runs and another drives
  them, give the driver the admitting principal's key or admit from the driver.
  Reconcile, attest, evaluate, meter, authorize and audit keep their own roles.
• Completion contracts for MCP tools. With mode = "production", contextosd
  refuses to start while an effectful MCP capability has no recovery.completion.
  Add one (a state_pointer into the tool's structuredContent and the states
  that mean confirmed and not_applied; see "MCP tools that report a state" in the
  deployment guide), or set [guards] require_completion_contracts = false while you
  add them. status_tool is now
  optional for MCP and still required for HTTP.

Also:

• Hold inspection's next_safe_step.action confirm_with_evidence_only is now
  confirm_or_attest_absence, and next_safe_step carries attest_absence (the
  route, or null).
• To use attestation, issue a separate key with attest and neither admit nor
  dispatch; configuration refuses keys that combine them.
• Audit consumers may see effect_absence_attested, and dispatch withheld as
  dispatch_stalled or shared_guarantee_link_missing.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.4-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.4/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.4/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.4
tar xzf "$asset"
cd contextos-v0.1.0-alpha.4-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.4 (also tagged v0.1.0-alpha.4), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource retains at most 1,024 operation receipts for its lifetime, settled ones
  included; size resources per order or per bounded period, not per customer. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence or released by an attestation of absence, which is a principal's audited
  claim, not proof. The peer board is limited to 256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.

ContextOS 0.1.0-alpha.3

ContextOS 0.1.0-alpha.3

The third alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.2

• A ten-minute path. examples/doctor.sh checks that your system can run the
  archive (platform, glibc, every binary, Python) and names one fix per failure.
  contextosd --check-config <path> validates a configuration without serving. The
  shared-guarantees demo now loses a provider response, holds the refund as unknown,
  confirms it from the provider's ledger export and leaves a verifiable receipt in
  receipts/shared-guarantees/.
• Find and explain holds. GET /v1/guarantees/{id}/holds lists resources with
  capacity held; GET /v1/guarantees/{id}/resources/{resource_digest}/holds maps each
  hold to its run, operation and attempt with the next safe step. Read-only
  (audit:read), tenant-scoped, and no tool arguments are returned.
• PostgreSQL failure drill. examples/postgres-drill races three contextosd
  processes on one shared limit through a SIGKILL, a lost reply and a database
  restart, then checks the balances against the provider's ledger.
• Fixes. A store failure while writing the dispatch gate no longer strands held
  capacity. Task-authorization amendments are audited before they take effect, and
  one that changes issued_by or confirmation_ref counts as widening. In Tower, a
  review by the agent's current owner or declarer never counts as approval. One
  unreadable ledger no longer breaks the holds listing.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.2

No storage migration is needed.

• An amendment that keeps scopes narrow but changes issued_by or
  confirmation_ref is now a widening: it needs a key with authorize (without
  admit/dispatch), a confirmation_ref and the same issued_by. Callers that
  only narrow should send those fields unchanged.
• Tower approvals whose reviewer is now the agent's owner or declarer stop counting;
  have another risk reviewer approve those agents.
• Clients of GET /v1/guarantees/{id}/holds must accept an entry
  {"resource_digest": ..., "unreadable": true} for a ledger that cannot be read.
• Audit consumers may see task_authorization_amendment_aborted after a
  task_authorization_amended whose commit failed; the run's admission is the
  authority on which authorization applies.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.3-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.3/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.3/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.3
tar xzf "$asset"
cd contextos-v0.1.0-alpha.3-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.3 (also tagged v0.1.0-alpha.3), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource retains at most 1,024 operation receipts for its lifetime, settled ones
  included; size resources per order or per bounded period, not per customer. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence. The peer board is limited to
  256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.