CompiledContext
Context
Only current, verified, in-scope evidence enters the run.
context-manifest.jsoncompiled
pack_versionctxpack.support@5.2.0
evidence_refs3 admitted / 0 unresolved
budget1,864 / 2,400 tokens
compiled_context_hashsha256:9f0b…c41a
Governed runtime specification
Agents can act.Make every action provable.
ContextOS is the harness around the model: it compiles what an agent may know, constrains what it may do, verifies what happened, and preserves the proof needed to replay or recover the run.
DecisionRecord · excerpt
verified{
"record_id": "dr_run_7f3a",
"decision_key": "support.refund.execute",
"status": "DECIDED",
"actor.delegated_user_id": "usr_771",
"lineage.pack_version": "ctxpack.support@5.2.0",
"policy_decisions[0].verdict": "allow",
"outputs.transaction_id": "txn_q9",
"tool_lineage[0].reversal_token": "rv_refund_txn_q9",
"replay.replay_packet_id": "rp_run_7f3a",
"audit.record_hash": "sha256:9ea1…"
}
identity boundpolicy enforcedrecovery ready
Reference trace
One refund run, from admitted context to recoverable effect.
The same run from the hero stays in view. Every stage below exposes the artifact the runtime produced—not a promise about what an agent usually does.
Recorded verdict
Policy
Policy remains outside the prompt and evaluates the live action envelope.
policy-verdict.jsonallow
bundlePOLICY_RETURNS_V4@4.0.0
identityverified · tenant matched
rulesR_REFUND_REQUIRES_IDV + R_HIGH_VALUE_REQUIRES_APPROVAL
approval_gateGATE_FINANCE_APPROVAL · satisfied
Identity-bound call
Tool
The model proposes. The Tool Gateway validates identity, scope, arguments, and effect risk.
tool-call-envelope.jsonauthorized
tool_call_idtc_121
workload_identityspiffe://contextos/agents/support
capabilitypayments.issue_refund
action_riskexternal_state · user_delegated · compensatable
approval_mode_effectivedestructive
idempotency_keyik_2x9k…0p3z
Evaluator verdict
Critic
The path is scored against evidence and gates, not against the agent’s confidence.
run scorecardaccept
1.00
policy
0.94
utility
0.86
latency
1.00
safety
0.91
cost
Normalized result
Effect
The gateway verifies external state and preserves a concrete recovery handle.
tool-result-envelope.jsonpostcondition met
effectrefund(txn_q9, 4200 INR)
mutation_refpayments:txn_q9
postconditionrefund.status = settled
reversal_tokenrv_refund_txn_q9
DecisionRecord
Receipt
The run closes only when the six operational questions have typed answers.
sealed receipt
dr_run_7f3a
What did it see?ctxpack.support@5.2.0 · 3 verified refs
Whose authority?agt_support on behalf of usr_771
Why was it allowed?POLICY_RETURNS_V4 · approval satisfied
What did it change?refund txn_q9 · postcondition confirmed
Why did it pass?policy 1.00 · utility 0.94 · safety 1.00
Can we recover?rp_run_7f3a · reversal token pinned
trace 4bf92f…4736record hash sha256:9ea1…
Five-plane architecture
Five responsibilities. One signed context crosses them all.
The planes are not five products in a catalog. They are one governed run viewed at five boundaries, joined by the same principal, budget, policy pins, and trace.
signed RunContext · principal_chain usr_771 → agt_support · tenant acme_prod · budget 4,720 tokens · policy pins v4 · trace 4bf92f…4736
plane
Intelligence
identity · evidence · memory
evidence snapshot
plane
Context
admission · compilation · budget
CompiledContext
plane
Decision
plan · verify · score
critic verdict
plane
Action
tools · effects · recovery
effect receipt
plane
Trust
policy · evaluation · replay
DecisionRecord
same run id · same authority ceilingevery boundary emits evidence
Why now
The model is one part.The runtime is the product.
Better models expand what agents can attempt. Production systems still need to decide what counts as admissible, complete, safe, and worth shipping.
Grade the trajectory
A plausible answer can hide a bad path. Evaluate instructions, tool choices, evidence, effects, and recovery—not only the final text.
Ship a release, not a prompt
Pin the model, harness, Context Pack, skills, tools, policy, evaluators, and rollback target as one compatible build.
Bound delegated authority
Every handoff carries identity, scope, budget, and approval mode. Authority narrows as work moves across agents and tools.
Recover from real effects
Postconditions, idempotency, compensation, and reversal tokens make safety survive contact with production systems.
Latest field work
Research that changes the runtime.
Build from the receipt backward