ContextOS 0.1.0-alpha.5

ContextOS 0.1.0-alpha.5

The fifth alpha of ContextOS: shared business limits for AI agents, enforced before
mediated tools act, with signed evidence of confirmed and unresolved effects.

This release is for evaluation and early integration. APIs and storage formats may
change. Passing the synthetic conformance and regression suites does not certify a
deployment or establish that a provider's effects are safe to repeat.

What changed since 0.1.0-alpha.4

• Upgrade a capability while its operations are open. retired_capabilities
  lists the manifests of versions an upgrade replaced. Operations claimed under a
  retired version are still reconciled, attested and recorded with it; it is never
  dispatched. Before, an upgrade left those operations refused as
  capability_not_pinned, holding their budget and shared capacity.
• Resources are no longer limited to 1,024 operations. A settled receipt is
  archived an hour after it is first seen settled, and its committed amount stays in
  the resource's total. The 1,024 cap now bounds receipts live at once; held receipts
  are never archived. Resource views add archived_receipts.
• Independent reconciliation. The principal that admitted a run can no longer
  assert its own effect not_applied or partial.
• Fixes. Release builds unwind on panic again, so one request's panic no longer
  ends the process. The Python client and Tower's AI assistant client no longer
  follow redirects that resent their credentials. --check-config and startup warn
  about effectful capabilities that task amount and resource limits cannot bound.

The full list is in the changelog.

Upgrading from 0.1.0-alpha.4

No storage migration is needed; existing shared-guarantee ledgers are read as they
are. Two changes can break existing setups:

• Reconcile with an independent principal. A run's admitting principal asserting
  not_applied or partial now gets 403 reconcile_not_independent. It may still
  query the provider or assert confirmed. Give on-call or reconciliation automation
  its own key with the reconcile scope; a principal that did not admit the run sends
  no executor generation. The Python client adds Client.reconcile(run_id, operation_id, *, outcome, evidence_ref).
• Python client transport. Redirects are no longer followed, and a plain http
  URL to a non-loopback host is refused unless you pass allow_http=True (to
  Client or AsyncClient).

Also:

• When you upgrade a capability, move the old manifest to retired_capabilities
  instead of deleting it until its operations are settled. See "Upgrading a
  capability with operations open" in the deployment guide.
• Startup may now log warnings for effectful capabilities that declare no amount or
  no resource_pointers; they do not stop it.

What is included

• contextosd: the governed tool gateway, protected state, admission, approvals,
  budgets, executor fencing and conservative reconciliation of unknown outcomes.
• Shared numeric resource ceilings across independent agent runs and replicas using
  one protected store. Pending and partial effects continue to consume capacity.
• ctx: offline validation, compilation, audit verification and release-gate tools.
• towerd and the prebuilt Tower UI: fleet evidence, role-based governance, reviews,
  guardrails and waivers. Optional AI assistance is off in the local example.
• An optional peer task board with leased claims and recovery. Task reports are
  advisory; they do not authorize effects or prove that work was completed safely.
• The Python HTTP client, documentation, licenses and dependency notices, plus local
  examples for shared guarantees, refunds, agent loops, peers, metering and Tower.

Framework integrations and native Python/Node/WASM bindings are available in the
source tree. This release does not publish packages to PyPI, npm or crates.io.

Downloads

Platform	Archive	Checksum
Linux x86-64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
Linux ARM64, glibc 2.28+ (tested on AlmaLinux 8 and Ubuntu 24.04)	Download	SHA-256
macOS Apple Silicon	Download	SHA-256

Archives need Python 3.9+, Bash and curl; Rust and Node.js are not needed to run the
bundled examples. Linux archives need GNU libc 2.28 or later (RHEL, AlmaLinux and
Rocky 8+, Debian 10+, Ubuntu 20.04+), not Alpine/musl. Windows and Intel macOS
binaries are not provided. The macOS binaries are not Apple-notarized.

Verify and try it

Download the archive and checksum for your platform. For example, on Apple Silicon:

asset=contextos-v0.1.0-alpha.5-aarch64-apple-darwin.tar.gz
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.5/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.5/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
gh attestation verify "$asset" --repo contextosai/ContextOS \
  --signer-workflow contextosai/ContextOS/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-alpha.5
tar xzf "$asset"
cd contextos-v0.1.0-alpha.5-aarch64-apple-darwin
./bin/contextosd --version
./examples/shared-guarantees/run.sh

The provenance check uses an authenticated GitHub CLI. The shared-guarantees demo
uses synthetic local services, requires no model key or payment account, races two
agents against one ceiling, reconciles pending exposure and verifies the audit.
Try ./examples/support-refund/run.sh and ./examples/tower/run.sh --serve next.

The release also includes per-crate CycloneDX JSON inventories of the locked Rust
workspace across all targets and features. These are source dependency inventories,
not exact per-binary SBOMs. Tower's production dependency licenses are included in
THIRD_PARTY_NOTICES.txt.

Container

The workflow builds a Linux x86-64 image at
ghcr.io/contextosai/contextosd:0.1.0-alpha.5 (also tagged v0.1.0-alpha.5), signs
its digest with keyless Sigstore signing and records GitHub build provenance.
The published release's verification evidence records the exact image digest.
Run towerd from the same image by selecting /usr/local/bin/towerd as its entrypoint.
Supply your configuration and secrets as described in the
deployment guide.

Alpha limits and support

• Guarantees apply to configured numeric ceilings and mediated tools sharing the
  tenant's protected store. They are opt-in and do not cover tools that bypass it.
• Unknown outcomes block capacity until reconciliation. Recovery from orphaned
  active dispatches remains conservative; do not retry an external effect blindly.
• A resource holds at most 1,024 receipts at once; a settled receipt leaves an hour
  after it is first seen settled, so sustained traffic above roughly 1,024 operations
  an hour on one resource is refused until older receipts age out. A hold
  whose dispatch started but was never observed stays held until reconciled with
  evidence or released by an attestation of absence, which is a principal's audited
  claim, not proof. The peer board is limited to 256 tasks and 1 MiB. Read the shared-guarantee
  and peer-coordination limits before integration.
• The legacy ICU comparator stays pinned to preserve existing compiler hashes.
  Upgrading its collation data requires an encoding migration.
• Alpha fixes land on main and in subsequent releases; old tags are not patched
  in place. There is no support SLA. Test backups, restore and your provider's
  reconciliation behavior before considering production use.

Use Discussions for questions
and issues for bugs.
Report vulnerabilities privately to security@contextosai.com or through
GitHub private reporting.

Code is Apache-2.0; prose is CC BY 4.0. The ContextOS name and logo remain subject to
the included trademark policy.