ContextOS 0.1.0-alpha.12

ContextOS 0.1.0-alpha.12

The twelfth alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects, and now
of whether the intended outcome happened.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.11

• Installable clients. pip install --pre contextos and
  npm install contextos-client install the HTTP clients from the public registries.
  The release also attaches the wheels (Linux x86-64 and ARM64 on glibc 2.28+ and
  macOS arm64 with the in-process kernel, plus a pure-Python wheel for every other
  platform) and the npm tarball, all with build provenance. Before its first
  admission each client reads the server's runtime_version and api_version from
  GET /v1/deployment: another API generation raises IncompatibleServer, another
  release warns.
• Draft a manifest from an MCP tool. ctx init-tool --mcp tools.json --tool <name> --adapter <id> copies the schemas and upstream pin and leaves every authority
  decision as a REVIEW: placeholder; nothing loads until each is answered.
• Evidence that cannot be self-asserted. With [guards] evidence = "strict",
  gated facts must arrive as evidence entries carrying a JWS from an
  [[evidence_issuers]] issuer. contextosd sets their integrity and freshness from the
  signature and its own clock, and [[evidence_subjects]] binds each requirement to
  the entity it concerns, so an authentic attestation about another order no longer
  satisfies it. Strict is the default under the enterprise profile.
• One ledger per real resource. resource_canonicalizer (exact,
  ascii_casefold, or provider, asking your identity service) makes aliases of one
  order share one ledger and one limit.
• Exposure from before ContextOS. POST /v1/guarantees/{id}/imports imports prior
  or outside spending into a guarantee's ledgers, idempotently and audited. An import
  that takes a resource past its limit is kept, the resource refuses new effects and
  ContextOSResourceOverLimit fires. examples/ops/import_exposure.py uploads a CSV.
• Aged holds reach their business owner. owner_route and owner_after_seconds
  on a guarantee deliver each hold older than the threshold once, with its diagnosis
  and next safe step, to that owner's webhook.
• Agents confined to the boundary. The Helm chart's agentEgress lets agent pods
  reach contextosd, DNS and a model gateway only, so with provider credentials only in
  contextosd's Secret it is the only path to the systems agents act on
  (egress recipe).
• Outcome contracts. A capability manifest may declare outcome: {witness, postcondition, binds, within_seconds, on_missed}. Once its effect is applied, the
  run cannot complete and decisions citing it cannot close until a separately
  credentialed witness attests the postcondition for the action's resource, amount
  and, with binds = "effect", the provider's receipt. A missed deadline escalates
  once. Outcome state is derived from the operation ledger and fenced to the attempt
  that may apply the effect, so crashes and retries neither lose an obligation nor
  close it early. examples/outcome-witness is a synthetic refund pilot.
• Keycloak. [[oidc]] claims are paths, keys can be discovered from the issuer,
  tenants can come from Keycloak organizations, and [oidc.delegation] accepts RFC
  8693 delegated tokens. [guards] user_binding checks a run's user against the token
  (guide,
  examples/keycloak, run in CI against Keycloak 26.8).

The full list is in the changelog.

Upgrading from 0.1.0-alpha.11

The schema is unchanged; no migration is needed. Check these before upgrading:

• Strict evidence (enterprise profile). With contextos.enterprise, contextosd
  refuses to start with evidence = "caller", and a run whose request.input.context
  names a gated evidence item is refused (422 evidence_in_request_context). Configure
  [[evidence_issuers]], have them sign the facts your packs gate, and send them as
  deps.evidence entries with an attestation. Run contextosd --check-config: it
  warns about strict evidence without issuers, gated requirements without an
  [[evidence_subjects]] binding, and rules that read a gated name from
  request.context (such a rule never matches under strict evidence).
• Node kernel package. The unpublished Node kernel package in bindings/node is
  named contextos-kernel; import the HTTP client as contextos-client.
• Client version check. Clients from this release warn when the server reports
  another release, and older servers report none. Upgrade servers and clients
  together, or pass check_server=False (Python) / checkServer: false (Node).

New scopes: exposure:import and outcome:report. Rust embedders: configuration
structs gain the new fields above.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing, conservative reconciliation of unknown outcomes and
  witnessed outcome contracts.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, manifest drafting, development attestation,
  audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, outcome witnesses, Keycloak, agent loops,
  peers, metering and Tower.
• The contextos wheels and contextos-client npm tarball, also published to PyPI
  and npm. crates.io stays unpublished.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.12-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.12/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.12/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.12
tar xzf "$asset"
cd contextos-v0.1.0-alpha.12-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/outcome-witness/run.sh, ./examples/support-refund/run.sh and
./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.12 (also tagged v0.1.0-alpha.12), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
  One guarantee applies per capability.
• Duplicate-effect guards and provider idempotency keys are scoped to a run. A
  business request redelivered into a new run is not recognised as the same request;
  the shared ceiling still bounds total exposure. Map redeliveries to their existing
  run upstream.
• Imports do not atomically stop spending outside ContextOS. To onboard a resource,
  pause or reroute other writers, import, then reopen.
• An outcome witness that reads the same provider reduces self-reporting; it is not an
  independent source of financial truth. The outcome example is synthetic.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource holds at most 1,024 receipts at once; a settled receipt leaves an hour
  after it is first seen settled, so sustained traffic above roughly 1,024 operations
  an hour on one resource is refused until older receipts age out. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence or released by an attestation of absence, which is a principal's audited
  claim, not proof. The peer board is limited to 256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• Keycloak delegation: read the preview and revocation limits in the
  Keycloak guide.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.