ContextOS 0.1.0-alpha.2

ContextOS 0.1.0-alpha.2

The second alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.1

• Linux archives run on older systems. The v0.1.0-alpha.1 Linux executables were
  built on Ubuntu 24.04, and contextosd failed to start elsewhere (for example
  GLIBC_2.38 not found on Ubuntu 22.04). This release builds them on AlmaLinux 8
  against glibc 2.28, so they run on RHEL, AlmaLinux and Rocky 8+, Debian 10+ and
  Ubuntu 20.04+. The release workflow checks each executable's glibc requirement and
  runs every archive on its build runner and, for Linux, on AlmaLinux 8.
  contextosd --version and towerd --version now work like ctx --version.
• HTTP effects need a completion contract (breaking). Every effectful HTTP
  capability must declare recovery.completion; a 2xx response settles an effect
  only when the body reports a listed state. Effectful 4xx responses are unknown
  until reconciled unless listed in recovery.not_applied_statuses. The MCP adapter
  applies the same rule to HTTP 400, 401, 403, 404, 405 and 415. contextosd refuses
  to start with an effectful HTTP capability that lacks the contract.
• Tower approvals are bound to risk (breaking). Reviews record each capability's
  risk, and any change, approval mode included, voids the approval and raises
  authority_drift. Expired reviews no longer count. Conflicting risk declarations
  keep the most consequential value of each dimension.
• Tower journal integrity. Governance changes and their journal entries commit
  together and are signed only after commit; each collection is journaled in commit
  order with collection_seq. Packs resolve within their own source; guardrail and
  waiver ids are full UUIDv7s.
• Governed compensation and shared findings (alpha), plus the "Why not a database
  transaction?" guide and the examples/why-not-a-row-lock demo.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.1

• Add recovery.completion to every effectful HTTP capability manifest, and list in
  recovery.not_applied_statuses only the 4xx statuses your provider documents as
  returned before any effect. See "Migrating an HTTP integration" in the
  guide.
• Re-review approved agents in Tower: reviews made by alpha.1 recorded no risk and no
  longer count. graph_digest values change.
• Tower journal numbering (collection_seq) starts with each collection's first
  change after upgrading; earlier entries carry none.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.2-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.2/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.2/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.2
tar xzf "$asset"
cd contextos-v0.1.0-alpha.2-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.2 (also tagged v0.1.0-alpha.2), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource retains at most 1,024 operation receipts. The peer board is limited to
  256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.

Verified release evidence

• Reviewed source: 1e116b131e22ccb785d2aa6aae893efdb7a47333, included in protected main. All required checks passed on its pull request, and the post-merge main run is green.
• Release build: all platform builds, packaged smoke tests (on each build runner, and for Linux also on AlmaLinux 8), source inventories, signing and draft assembly passed.
• All three downloaded archives passed SHA-256 checks and GitHub provenance verification for the exact release workflow, tag and source commit. The binaries, examples, docs and license notices are present.
• The downloaded Apple Silicon archive passed the shared-guarantees, support-refund and Tower demos with only /usr/bin and /bin on PATH (no Rust or Node).
• Both container version tags resolve to the same digest and allow anonymous pulls. The digest's Sigstore signature and GitHub provenance verified for the exact workflow, tag and source. The image runs as nonroot; with a read-only root filesystem, contextosd served /healthz and /readyz, and towerd --version ran.

Measured platform requirements

All six Linux executables (x86-64 and ARM64) require glibc 2.28 or newer, measured from their versioned symbols. The release workflow ran each Linux archive on AlmaLinux 8 (glibc 2.28) and Ubuntu 24.04. The downloaded ARM64 executables also started on Ubuntu 22.04 (glibc 2.35), where v0.1.0-alpha.1 failed. These archives do not target musl/Alpine.

All three macOS binaries declare a macOS 11.0 minimum in their headers and use system libraries rather than Homebrew libraries. This is a measured deployment target, not a claim that every older macOS version was tested. They are Apple Silicon binaries and are not Apple-notarized.

Exact container digest

ghcr.io/contextosai/contextosd@sha256:9a07282e013d89455becaa78164abc7eb5554466e90021feedb875e832620c1a

Verify its signature and provenance, then pin this digest in deployment configuration:

cosign verify ghcr.io/contextosai/contextosd@sha256:9a07282e013d89455becaa78164abc7eb5554466e90021feedb875e832620c1a \
  --certificate-identity https://github.com/contextosai/ContextOS/.github/workflows/release.yml@refs/tags/v0.1.0-alpha.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/contextosai/contextosd@sha256:9a07282e013d89455becaa78164abc7eb5554466e90021feedb875e832620c1a --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.2 --source-digest 1e116b131e22ccb785d2aa6aae893efdb7a47333

Release immutability is enabled. After publication, verify the release and any downloaded asset with gh release verify v0.1.0-alpha.2 --repo contextosai/ContextOS and gh release verify-asset v0.1.0-alpha.2 <file> --repo contextosai/ContextOS.