Skip to content

ContextOS 0.1.0-alpha.17

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 05:01
· 67 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.1.0-alpha.17
3c34d10
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ContextOS 0.1.0-alpha.17

The seventeenth alpha of ContextOS. It adds runtime controls the 2025–26 research on
securing agents ranks highest and a gateway can enforce on its own: information-flow
labels, circuit breakers that trip the kill switch, a trusted action monitor, and a
review-time floor for approvals. Every one is off until it is configured. It also
meters model calls made through LiteLLM, and gives Tower an approvals inbox, a
revocations view and model spend.

What changed since 0.1.0-alpha.16

Runtime guards (off unless configured; see the GUIDE and threat-model entries
T41–T44)

  • [guards.information_flow]: each run carries an integrity label and a
    classification label. Both rise with the tool output its agent receives.
    Capability manifests declare flow.output_integrity,
    flow.output_classification and flow.egress_ceiling. Undeclared output counts
    as untrusted INTERNAL. Three rules apply:

    • An effect after untrusted input needs an approval of the exact action.
    • Egress above a capability's ceiling is denied.
    • The "rule of two" covers untrusted input combined with CONFIDENTIAL data and
      egress or an external effect.

    Labels pass to delegated children and back. mode = "observe" only audits
    (information_flow_decision).

  • [[guards.circuit_breakers]] counts effects or refusals per agent, admitting
    principal or tenant, in a sliding window. At its threshold, a breaker refuses the
    calls it governs (circuit_open). With trip = "revoke", it also revokes the
    target in the kill switch (by: circuit_breaker:<id>), so the target stays stopped
    until an operator restores it. Each trip is audited (circuit_breaker_tripped). The
    new alert ContextOSCircuitBreakerOpen has a runbook entry.

  • [providers.action_monitor] with [guards.action_monitor]: your monitor model
    scores every effectful or data-sending call before it is sent. It sees the action
    binding and the run's recent calls.

    • A score at ask_at needs an approval of the exact action.
    • A score at deny_at is denied.
    • A run whose summed suspicion reaches run_budget needs approvals from then on.
    • An unavailable monitor gets on_unavailable, which defaults to ask.

  • [guards.approval_review] sets min_review_seconds. An approval decided sooner
    than that after the gateway requested it is not used (approval_review_too_fast,
    obligation review_again). The audit records the seconds measured. Scope the floor
    by capability or amount, as with step-up.

  • Each run pins the runtime guards' policy it was admitted under
    (guard_policy_ref), so its decisions cite the configuration that decided them.

Model metering

  • contextos-litellm (integrations/litellm) is a LiteLLM proxy callback. It claims
    each model call's reservation before forwarding it, and caps the call's output
    tokens to the reservation. It then settles the usage the provider reported, off the
    response path. It fails closed when contextosd is unreachable.
  • POST /v1/runs/{run_id}/usage/claim (meter scope) claims a reservation for the
    one call a metering gateway is about to forward, across replicas. usage/settle
    accepts model.
  • New audit entries record usage: usage_refused, usage_claimed and
    usage_settled.

Tower

  • An approvals inbox lists open escalations across runtimes in one queue. Risk
    reviewers and operators can resolve them from it.
  • Runtime sources can be managed from the console (probe, add, pause, resume, retry
    verification, reload keys, remove), with a reason in Tower's journal for each
    change. Source keys can be read from mounted secret files.
  • A Revocations view shows every revocation in force across the fleet. It reconciles
    each runtime's live list against its verified audit chain.
  • Restoring a revocation takes two people: one operator requests the restore and a
    second approves it.
  • Model spend per agent, team and model keeps measured usage and self-reported usage
    apart. New findings flag uncovered and unmetered model spend.

Documentation

The changelog
lists every change.

Upgrading from 0.1.0-alpha.16

  • Tower restores need two operators by default. [governance] two_person_restore
    now defaults to true, so POST /api/fleet/restore answers
    409 two_person_required. Set it to false to keep one-operator restores.
  • Turn the new guards on only after every replica runs alpha.17. An alpha.16
    replica does not enforce them.
  • Runs in flight when a guard is first turned on are not pinned to it. For such a
    run, a call the information-flow guard or the action monitor would send for approval
    is refused instead (flow_policy_unpinned, monitor_policy_unpinned). Turn guards
    on between workloads, or expect these refusals until the runs finish.
  • Startup notes every capability without flow labels while the
    information-flow guard is on. Its output counts as untrusted INTERNAL, and it may
    send out at most INTERNAL data. Label capabilities before turning the guard on.
  • The store holds new document kinds and needs no migration. No configuration key,
    API or storage format is removed.

Downloads

Platform Archive Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04) Download SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04) Download SHA-256
macOS Apple Silicon Download SHA-256

Archives need Python 3.9+, Bash and curl. To verify an archive's checksum and
provenance, follow the
alpha.12 notes
with v0.1.0-alpha.17 as the tag.

The container image is ghcr.io/contextosai/contextosd:0.1.0-alpha.17 for
linux/amd64 and linux/arm64. It is signed and carries build provenance.

Install the clients with pip install --pre contextos-client and
npm install contextos-client. contextos-litellm is not on PyPI yet. Install it
from this tag:
pip install "contextos-litellm @ git+https://github.com/contextosai/ContextOS@v0.1.0-alpha.17#subdirectory=integrations/litellm".

The alpha limits in the alpha.12 notes apply unchanged. There is no support SLA.
Report vulnerabilities privately to security@contextosai.com.

Code is Apache-2.0; prose is CC BY 4.0.

Assets 28
Loading