ContextOS 0.1.0-alpha.16

ContextOS 0.1.0-alpha.16

The sixteenth alpha of ContextOS. It hardens what alpha.15 added for production:
provider failover now survives an endpoint that hangs, and the built-in TLS server
defends itself against slow and abusive clients without a proxy in front.

What changed since 0.1.0-alpha.15

Providers

• A capability's timeout_ms now covers every endpoint attempt. A read-only call
  gives each attempt an equal share of what remains, so a primary that accepts the
  request and never answers is given up in time for a fallback to answer. Before, the
  whole call timed out as unknown. Effectful calls are unchanged: a hang stays
  unknown and is never resent.
• Any 5xx answer counts toward outlier ejection, so a replica that keeps answering
  500 is ejected. A 500 still moves no call on: the endpoint answered, and the
  error is as often the tool's own.
• A fallback endpoint on another origin than endpoint is logged as a warning at
  startup. Every listed endpoint is sent the provider credential, so list only
  endpoints in the provider's trust domain.

Serving

• [server.tls] max_connections (default 10000) caps open connections; further
  clients wait in the accept queue.
• [server.tls] header_timeout_secs (default 30) disconnects an HTTP/1.1 client that
  trickles its headers, and closes a connection with no request in progress for that
  long, over either protocol. A slow request or a streaming response is never cut off.
• HTTP/2 connections allow 200 concurrent requests and are pinged every 30 seconds,
  then closed if a ping goes unanswered for 20.
• A failed accept (out of file descriptors, for one) backs off from 5 ms to one second
  instead of spinning at full CPU.
• contextosd --mcp-stdio forwards initialize and every notification in order, and
  bounds each stdin line at 16 MiB while reading it rather than after buffering it.

Observability

• A governed call that fails on infrastructure (store, audit chain, shared guarantee,
  manifest or outcome contract) now leaves a contextos::access line with
  status="error" and the failing dependency as its reason, so dashboards that count
  access lines count failed calls too.

Documentation

• Pack-binding claim leases assume replicas with synchronized clocks (NTP).
• The release checklist now includes moving contextosai.com to the release.

The changelog
lists every change.

Upgrading from 0.1.0-alpha.15

• Idle TLS connections close after 30 seconds when [server.tls] is configured.
  Clients that pool connections reconnect transparently; set header_timeout_secs
  higher if a client keeps idle connections open longer and does not retry.
• Read-only calls with fallbacks give the primary a share of timeout_ms, not all
  of it (half with one fallback). Raise timeout_ms if a healthy primary routinely
  answers in more than that share.
• Replicas answering 500 can now be ejected. Ejected endpoints are still tried,
  last, so no call is refused without an attempt.
• Log volume: calls that fail on infrastructure add one access line each.
• No configuration key, API or storage format is removed.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl. Verify an archive's checksum and provenance
as in the alpha.12 notes,
with v0.1.0-alpha.16 as the tag. The container image is
ghcr.io/contextosai/contextosd:0.1.0-alpha.16 for linux/amd64 and linux/arm64,
signed and with build provenance. The clients are pip install --pre contextos-client
and npm install contextos-client.

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.