ContextOS 0.1.0-alpha.4

ContextOS 0.1.0-alpha.4

The fourth alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.3

• Release holds left by a dead executor. An attempt whose dispatch started and
  recorded no fact used to hold its budget, task-limit charge and shared capacity
  forever. POST /v1/runs/{run_id}/operations/{operation_id}/attest-absence lets a
  principal holding the new attest scope (never with admit or dispatch) state,
  citing the provider's records, that the effect did not apply. It is accepted only
  once those records were checked through the attempt's start plus the capability's
  timeout plus 300 seconds; the run's executor is fenced and effect_absence_attested
  is signed before anything is released.
• Runs belong to the principal that admitted them. Another principal in the
  tenant that learns a run id can no longer drive the run.
• MCP completion contracts. In production, an effectful MCP capability must
  declare recovery.completion; a result reporting pending or failed is no
  longer counted as a confirmed effect.
• Fixes. A dispatch that stalls more than 120 seconds between its claim and the
  provider call sends nothing, so an attestation cannot race a paused dispatcher. A
  guarded dispatch whose shared-guarantee link is missing is withheld instead of sent
  unmarked. The Tower console sets nosniff and no-store itself. Dependency
  updates for Tower, the framework examples and CI actions.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.3

No storage migration is needed. Two changes can break existing setups:

• One principal per agent service. Tool calls, status, takeover,
  complete/fail/cancel, decisions, usage reservation, checkpoints, memory, peer work,
  findings, compensation and delegation from a parent answer 404 run_not_found to
  any principal other than the one that admitted the run. If several services share
  one principal, nothing changes; if one service admits runs and another drives
  them, give the driver the admitting principal's key or admit from the driver.
  Reconcile, attest, evaluate, meter, authorize and audit keep their own roles.
• Completion contracts for MCP tools. With mode = "production", contextosd
  refuses to start while an effectful MCP capability has no recovery.completion.
  Add one (a state_pointer into the tool's structuredContent and the states
  that mean confirmed and not_applied; see "MCP tools that report a state" in the
  deployment guide), or set [guards] require_completion_contracts = false while you
  add them. status_tool is now
  optional for MCP and still required for HTTP.

Also:

• Hold inspection's next_safe_step.action confirm_with_evidence_only is now
  confirm_or_attest_absence, and next_safe_step carries attest_absence (the
  route, or null).
• To use attestation, issue a separate key with attest and neither admit nor
  dispatch; configuration refuses keys that combine them.
• Audit consumers may see effect_absence_attested, and dispatch withheld as
  dispatch_stalled or shared_guarantee_link_missing.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.4-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.4/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.4/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.4
tar xzf "$asset"
cd contextos-v0.1.0-alpha.4-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.4 (also tagged v0.1.0-alpha.4), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource retains at most 1,024 operation receipts for its lifetime, settled ones
  included; size resources per order or per bounded period, not per customer. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence or released by an attestation of absence, which is a principal's audited
  claim, not proof. The peer board is limited to 256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.