ContextOS 2026

ContextOS 2026 keeps the five-plane architecture and changes what qualifies as a governed run. The original framework assumed a mostly synchronous agent choosing API tools from a prompt-sized context. Current systems reason across modalities, operate browsers and computers, delegate to other agents, pause for hours or days, and route work across models with different capabilities. Those are runtime properties, not prompt-design details.

What changed since the original framework

The seven 2026 invariants

1. Authority is explicit. Every model call, tool call, delegation, and approval names the principal chain and scope ceiling.
2. Risk is multidimensional. Policy evaluates effect, authority, reversibility, interaction, and data classification independently.
3. Context is evidence. Every material block has provenance, trust treatment, freshness, and a reason for inclusion; omission is recorded too.
4. Execution is durable. A long-running run can checkpoint and resume without repeating effects or silently refreshing pinned inputs.
5. Delegation narrows. A child agent receives a strict subset of the parent’s authority, tools, data scope, time, and budget.
6. Models are replaceable dependencies. Routing is deterministic for identical recorded inputs, and every fallback preserves the requested contract.
7. Change is governed. Agents may propose improvements; they do not silently promote policy, memory, prompts, tools, evaluators, or routing rules.

Revised contract stack

RunContext
  authority + tenant + trace + monotonic budget + session pins
    -> ContextPack
       policy + evidence requirements + tools + memory + decision specs
    -> CompiledContext
       selected blocks + provenance + omissions + controls + hash
    -> RoutingDecision + bounded decision loop
       model profile + plan + critic verdicts + delegation lanes
    -> ToolEnvelope / AgentDelegationEnvelope
       ActionRisk + principal chain + policy decision + idempotency
    -> DecisionRecord + ReplayPacket
       outcome + effects + evidence + lineage + scorecard + replay state

The reference compiler remains deterministic. Model inference may be probabilistic, but artifact selection, policy evaluation, budget checks, capability filtering, and threshold comparisons are reproducible from recorded inputs.

Native action risk

The original ApprovalMode values—read_only, local_write, network, delegated, and destructive—are useful operational labels but not a coherent ordering. network describes location, delegated describes authority, and destructive describes reversibility.

The 2026 contract adds ActionRisk:

{
  "effect": "external_state",
  "authority": "user_delegated",
  "reversibility": "compensatable",
  "interaction": "browser",
  "data_scope": "CONFIDENTIAL",
  "decision_ttl_seconds": 120
}

Policy checks each dimension and the actual arguments immediately before execution. The legacy approval mode remains in the v1 ToolCallEnvelope; native risk fields are additive in v1 and become required in the next major envelope.

Durable and delegated execution

A durable session pins its Context Pack, policy bundles, knowledge snapshot, model-routing policy, evaluator suite, and tool registry view. Resume restores atomic budget usage and continues after the last committed Critic verdict. It never replays a completed effect merely because a process restarted.

A delegation is a derived run, not an informal message. The parent issues a child identity claim with:

• allowed intents and output schema;
• capability allow-list and argument ceilings;
• data classification ceiling;
• token, cost, tool-call, and wall-clock sub-budgets;
• expiration and cancellation semantics;
• a rule that child effects remain isolated until the parent Critic accepts them.

The parent’s authority is an upper bound. Delegation cannot mint permission, reset consumed budget, or hide model/tool calls from the parent trace.

Multimodal and computer-use agents

Screenshots, audio, documents, and UI state enter the Context plane as content-addressed artifacts. Extracted text is derived evidence and retains a pointer to the source artifact and extraction model. Instructions found inside retrieved content or a UI are untrusted data unless policy explicitly promotes them.

Computer-use actions require a pre-action observation, a bounded action proposal, a post-action observation, and an environment receipt. Sensitive inputs are referenced through secret handles, not exposed to the model as plaintext. For irreversible or ambiguous UI actions, the Critic must prefer a human handoff over coordinate guessing.

Adoption path

What is deliberately not changed

• The five planes remain the architecture map; new capabilities fit within them.
• Policy stays outside model reasoning.
• The Tool Gateway remains the only path to external effects.
• Durable memory still requires promotion and provenance.
• DecisionRecord remains the audit receipt, and replay remains the test of operational truth.
• Protocols such as MCP and A2A describe interoperability; they do not grant authority.

Review checklist

A 2026-ready workflow can answer all of these with typed artifacts:

• Which principal and delegated authority permitted each effect?
• What were the action’s effect, reversibility, interaction, and data boundaries?
• What exact context did each model see, and which candidate context was omitted?
• Which model profile was selected, why, and which fallbacks were rejected?
• Can the run resume without refreshing pins or repeating side effects?
• Did every child agent receive narrower authority and a real sub-budget?
• Can the decision be replayed with side effects disabled?
• Can every promoted harness change be rolled back independently?

Next steps

• Use Foundations for the plane-by-plane operating model.
• Use Governance for native action risk and compatibility approval modes.
• Use Orchestration for durable sessions and subagent lanes.
• Use AI Gateway and LLM Router for governed model selection.
• Use API Contracts and Runtime API Schemas for executable envelopes.