ContextOS 0.1.0-alpha.3

ContextOS 0.1.0-alpha.3

The third alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.2

• A ten-minute path. examples/doctor.sh checks that your system can run the
  archive (platform, glibc, every binary, Python) and names one fix per failure.
  contextosd --check-config <path> validates a configuration without serving. The
  shared-guarantees demo now loses a provider response, holds the refund as unknown,
  confirms it from the provider's ledger export and leaves a verifiable receipt in
  receipts/shared-guarantees/.
• Find and explain holds. GET /v1/guarantees/{id}/holds lists resources with
  capacity held; GET /v1/guarantees/{id}/resources/{resource_digest}/holds maps each
  hold to its run, operation and attempt with the next safe step. Read-only
  (audit:read), tenant-scoped, and no tool arguments are returned.
• PostgreSQL failure drill. examples/postgres-drill races three contextosd
  processes on one shared limit through a SIGKILL, a lost reply and a database
  restart, then checks the balances against the provider's ledger.
• Fixes. A store failure while writing the dispatch gate no longer strands held
  capacity. Task-authorization amendments are audited before they take effect, and
  one that changes issued_by or confirmation_ref counts as widening. In Tower, a
  review by the agent's current owner or declarer never counts as approval. One
  unreadable ledger no longer breaks the holds listing.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.2

No storage migration is needed.

• An amendment that keeps scopes narrow but changes issued_by or
  confirmation_ref is now a widening: it needs a key with authorize (without
  admit/dispatch), a confirmation_ref and the same issued_by. Callers that
  only narrow should send those fields unchanged.
• Tower approvals whose reviewer is now the agent's owner or declarer stop counting;
  have another risk reviewer approve those agents.
• Clients of GET /v1/guarantees/{id}/holds must accept an entry
  {"resource_digest": ..., "unreadable": true} for a ledger that cannot be read.
• Audit consumers may see task_authorization_amendment_aborted after a
  task_authorization_amended whose commit failed; the run's admission is the
  authority on which authorization applies.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.3-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.3/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.3/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.3
tar xzf "$asset"
cd contextos-v0.1.0-alpha.3-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.3 (also tagged v0.1.0-alpha.3), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource retains at most 1,024 operation receipts for its lifetime, settled ones
  included; size resources per order or per bounded period, not per customer. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence. The peer board is limited to
  256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.