ContextOS 0.1.0-alpha.11

ContextOS 0.1.0-alpha.11

The eleventh alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

This is the first published release since 0.1.0-alpha.5. 0.1.0-alpha.6 through
alpha.10 were tagged but never published as releases; read the
alpha.6 notes
too if you are upgrading from alpha.5. alpha.7's archives lacked files its README
names, alpha.8's container exited under the Helm chart, review of alpha.9 found a
pinned capability on a non-MCP adapter refused forever and one tenant able to crowd
others out of Tower's fleet view, and alpha.10 could not reach providers behind a
private CA. All are fixed here.

What changed since 0.1.0-alpha.6

• Services behind your own CA. Production requires HTTPS for providers and
  adapters, and every client trusted only the public roots built into the binary, so
  providers, the KMS, OIDC issuers or internal APIs behind an organisation's own CA
  were unreachable. CONTEXTOS_CA_BUNDLE names a PEM file of CA certificates that
  every outgoing connection trusts too, from contextosd and towerd alike; a file
  without certificates stops startup, and --check-config reports it.
• Kubernetes, as deployed. The Helm chart migrates the schema as its owner before
  every install and upgrade (migration.enabled), so the server's role needs no DDL
  rights, and takes sidecars and extra mounts and environment (extraContainers,
  extraVolumes, extraVolumeMounts, extraEnv). CI installs it on a kind cluster in
  production mode: PostgreSQL with an owner and a least-privilege role, providers
  over HTTPS behind a generated CA, a run admitted and a refund dispatched, the kill
  switch, audit verification, a rolling restart and an upgrade.
• Tower caps its whole fleet at 500,000 agents behind the per-tenant bound.
• From clone to your own governed agent. ./examples/dev-server.sh runs
  contextosd locally with the quickstart's pack and synthetic providers and prints
  the URL and token to point your agent at. The README's "Govern your own agent"
  section, a glossary and
  install notes for the Python client cover the rest.
  contextosd --help exists, and --check-config lists every missing environment
  variable at once.
• Deployable as documented. The container image starts under the Helm chart (the
  chart's arguments no longer add a second --config). A least-privilege database
  role can run the server: contextosd --migrate <config> creates or upgrades the
  schema as its owner, and a current schema needs no DDL at start.
• For operators. The guide covers backup and restore (and what to do before serving
  after a restore), the production refusals and the settings behind them, and database
  grants. examples/ops/unresolved.py lists effects awaiting reconciliation with the
  call for each. The Helm chart README has a worked values file. --check-config warns
  when no caller can authenticate, when a capability's adapter is not configured, and
  when production signs the audit chain with a seed rather than a KMS.
• Review fixes. Startup refuses an upstream pin outside MCP adapters (it could
  never be checked); unverified pinned tools are re-checked every 15 seconds; Tower
  bounds agents per tenant; migrations run under an advisory lock, one replica at a
  time; --check-config names every pack where a run could declare one intent to
  avoid another's rules. New informational alerts track agent-binding and
  pack-intent mismatches while either guard runs in observe.
• Intent-scoped rules can no longer be stepped around. A policy rule scoped to an
  intent applied only to runs declaring that intent, and the caller declares it, so a
  run declaring another intent got the pack's tools without the rule. A run's intent
  must now be one its pack's rules name ([guards] pack_intents): refused with the
  enterprise profile, counted and recorded otherwise.
• Upstream drift checks survive restarts. A capability pinned to its upstream MCP
  tool refuses calls (upstream_tool_unverified, retryable) until the replica has
  checked it once, including when the provider is unreachable at startup.
• Step-up thresholds per currency. amount_at_least names a currency; an amount
  in a currency without a threshold always needs step-up.
• Hardening from review. A token endpoint's oversized expires_in no longer
  crashes the runtime; the evidence endpoint refuses a looping archive chain; feedback
  closures accept only identifier-shaped evidence references; Tower's fleet model is
  bounded in memory as documented.
• Scope, written down. SCOPE.md now covers which intent a run
  serves and how evidence gates are satisfied. Spec proposals 0006 (intent-scoped
  restrictions) and 0007 (resume after delegated children close) are drafts for the
  specification.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.6

From 0.1.0-alpha.5, first apply the
alpha.6 upgrade notes
(agent binding and upstream pins under the enterprise profile), then these.

The schema gains a version table (contextos_schema_version). A server whose database
role owns the schema migrates on start, as before. With a least-privilege role, run
contextosd --migrate <config> as the owner first, then grant the runtime role
SELECT on contextos_schema_version (GUIDE section 12, Store). The image's
entrypoint is now the bare contextosd binary with --config /etc/contextos/contextosd.toml as its default arguments: if you run it with your own
arguments, pass --config yourself. Two more changes can need configuration:

• Pack intents (enterprise profile). With contextos.enterprise, admission refuses
  a run whose intent its pack's rules do not name (422 intent_not_governed). Without
  the profile, such runs are admitted and counted in
  contextos_pack_intent_mismatches_total. Before upgrading an enterprise deployment,
  set [guards] pack_intents = "observe", watch the counter reach zero (or give each
  intent you serve its own rules), then remove the override.
• Step-up thresholds. [guards.approval_step_up] amount_at_least = 100000 no
  longer parses; write amount_at_least = [{ currency = "USD", minor_units = 100000 }].

run_admitted gains pack_intent, and a delegated run's agent_binding gains
named_by_credential. Rust embedders: GuardsConfig gains pack_intents, and
StepUpPolicy::amount_at_least is a Vec<AmountThreshold>.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.11-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.11/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.11/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.11
tar xzf "$asset"
cd contextos-v0.1.0-alpha.11-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.11 (also tagged v0.1.0-alpha.11), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource holds at most 1,024 receipts at once; a settled receipt leaves an hour
  after it is first seen settled, so sustained traffic above roughly 1,024 operations
  an hour on one resource is refused until older receipts age out. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence or released by an attestation of absence, which is a principal's audited
  claim, not proof. The peer board is limited to 256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.