Project Status
What is specification, reference code, runtime and Tower; where each lives, its version, license and maturity, and how to try the runtime.
This site publishes the specification and its schemas. The source repository behind it is not public; the deterministic TypeScript conformance reference is readable as an unmodified, checksummed snapshot in the runtime repository, pinned to the spec revision it was copied from, with the vectors the runtime is tested against. contextosai/ContextOS publishes a Rust runtime that enforces the contract at the tool boundary, and Tower, a governance plane for fleets of runtimes. When a page on this site says “this repository is not a production runtime”, it means the specification’s repository.
What exists today
| Artifact | Where | Version | License | Maturity |
|---|---|---|---|---|
| Specification prose | This site | Reviewed dates per page | CC BY 4.0 | Normative where a page says so |
| Published JSON schemas | Served by this site under /schemas/; copied into the runtime’s schemas/ | Versioned per schema, for example execution-contract.v1 | Apache-2.0 | Stable contract |
| TypeScript conformance reference | Snapshot in the runtime’s conformance/reference | Unversioned; pinned to spec revision 7e2462f | Apache-2.0 | Executable reference, not a runtime |
Runtime: contextosd gateway, ctx CLI, embeddable kernel | contextosai/ContextOS | v0.1.0-alpha.16, 2026-11-06, commit 150aecc | Apache-2.0 (code), CC BY 4.0 (docs) | Alpha: APIs and storage formats change |
Tower: towerd and console | contextosai/ContextOS | Ships in the same release | Apache-2.0 (code), CC BY 4.0 (docs) | Alpha |
| Deployment-owned controls | Your environment | — | — | Yours to supply and evidence |
The ContextOS name and logo are covered by the runtime repository’s trademark policy. The clients are published as contextos-client on PyPI and npm; the runtime ships as release archives and a signed container image, and is not on crates.io.
Stable contract and alpha extensions
The portable contract is what this site’s schemas and normative pages define: context admission, action and approval binding, execution boundaries, durable operations and conserved run budgets, evidence and conformance. Another runtime can implement it without adopting the Rust code.
The Rust runtime also ships alpha extensions that are not part of the portable contract yet. They are documented in the runtime repository and may change before they are proposed here:
- Shared guarantees: one business ceiling, such as INR 1,000 of refunds per order, enforced across independent agent runs and replicas that share a protected store. Unknown outcomes stay held until reconciled. See the shared guarantees guide.
- Governed compensation: an effect can declare the capability that undoes it, run as a new governed operation, at most once. See the compensation guide.
- Shared findings and a peer task board for teams of agents. Reports are advisory; they do not authorize effects.
How the runtime relates to the specification
The runtime’s kernel checks its semantics against golden vectors generated from a pinned snapshot of the TypeScript reference; its conformance README explains how to regenerate them. Agreement on those vectors is reference parity for the covered cases. It is not deployed conformance, which needs evidence for the exact workflow, implementation, release and environment.
The runtime enforces what the reference can only check: protected compare-and-swap state, executor fencing, adapter dispatch with declared provider recovery, signed hash-chained audit, and recovery of unknown outcomes. It cannot supply what belongs to your deployment.
| The runtime provides | Your deployment supplies |
|---|---|
| Authenticated API, policy and approval checks at dispatch, budget and shared-exposure ledgers | Identity providers, authority and approval services, the business rules |
| Revision-checked state in PostgreSQL (in-memory for demos) | A PostgreSQL deployment, backups and restore drills |
| MCP and HTTP adapters that refuse to guess an outcome | Each provider’s recovery contract: which responses prove an effect applied or not |
| Ed25519-signed audit and an offline verifier | Independently trusted keys and anchors, key management |
| Tower views, reviews, guardrails and waivers | Who may review, approve and assert outcomes |
Try the runtime in ten minutes
No Rust, model key or payment account is needed. On macOS (Apple Silicon) or Linux with glibc 2.28 or newer (RHEL, AlmaLinux or Rocky 8+, Debian 10+, Ubuntu 20.04+), with Python 3.9+ and Bash:
asset=contextos-v0.1.0-alpha.16-aarch64-apple-darwin.tar.gz # or the Linux x86-64 / ARM64 archive
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.16/$asset"
curl -fLO "https://github.com/contextosai/ContextOS/releases/download/v0.1.0-alpha.16/$asset.sha256"
shasum -a 256 -c "$asset.sha256"
tar xzf "$asset" && cd "${asset%.tar.gz}"
./examples/shared-guarantees/run.shThe demo races two agents requesting INR 800 each against one INR 1,000 ceiling on an order. One refund reaches the synthetic provider; the other is withheld before dispatch. A pending provider task holds capacity and blocks a further refund until a provider query confirms it. A lost provider response is held rather than retried, and each step prints limit / committed / held / available. The script then exports the audit log and verifies it offline; output ends with "verified": true, and the receipts stay in receipts/shared-guarantees/. examples/doctor.sh checks the platform, glibc and Python first if anything fails to start. The release notes show how to check the archive’s provenance with gh attestation verify.
To point your own agent at a runtime, ./examples/dev-server.sh in the same directory starts one with synthetic providers and prints its URL and token; the clients install with pip install --pre contextos-client (the module is contextos) and npm install contextos-client; the runtime’s integration guides cover eleven agent frameworks. For production, the deployment guide and the Helm chart cover PostgreSQL, schema migration, keys, private CAs, backups and alerts.
Releases
| Release | Date | Source | Notes |
|---|---|---|---|
v0.1.0-alpha.16 | 2026-11-06 | 150aecc | Production hardening: provider failover that survives an endpoint that hangs (one time budget per call; effects still never resent), replicas answering 500 ejected, a warning when a fallback is on another origin; the built-in TLS server bounds connections, slow headers and idle clients; calls that fail on infrastructure leave an access-log line. |
v0.1.0-alpha.15 | 2026-11-06 | 66f8c2a | Running the gateway in production: TLS and mutual TLS without a proxy, with certificate rotation; failover between provider replicas that never repeats an effect; a trace span and access log line for every governed call; MCP over stdio, Origin and protocol-version checks; generated configuration and metrics references. |
v0.1.0-alpha.14 | 2026-11-05 | 8cab289 | Authoring and operating Context Packs: ctx test, ctx plan and POST /v1/plan, ctx build from shared rule libraries, ctx inspect; tool-call checks that stop before dispatch; pack versions added while the server runs; audit delivery to a SIEM. Breaking: a pack reference is bound to its digest when first loaded, so a pack edited in place needs a new pack_version. |
v0.1.0-alpha.13 | 2026-11-04 | 3c88a19 | The Python client on PyPI as contextos-client (import contextos), the npm package’s name; PyPI refuses contextos. Nothing else changed. |
v0.1.0-alpha.12 | 2026-11-03 | 5047479 | Installable clients (contextos-client on npm; PyPI from alpha.13) and ctx init-tool; strict evidence signed by named issuers and bound to its subject; canonical resource identity; imported prior exposure; aged holds routed to business owners; agent egress confinement in the Helm chart; outcome contracts that keep a run open until a separate witness attests the result; Keycloak delegation. Breaking: the enterprise profile requires strict evidence, so gated facts must arrive as signed evidence entries. |
v0.1.0-alpha.11 | 2026-10-31 | 4ad3d46 | A local server for your own agent; services behind a private CA (CONTEXTOS_CA_BUNDLE); a Helm chart that migrates its schema as the owner, tested on Kubernetes in production mode; pack intents, so intent-scoped rules cannot be skipped by declaring another intent; upstream MCP pins checked before first use. Breaking: with the enterprise profile, runs whose intent the pack’s rules do not name are refused; approval step-up thresholds name a currency. v0.1.0-alpha.6 to alpha.10 were tagged but not published; read the alpha.6 upgrade notes too if you come from alpha.5. |
v0.1.0-alpha.5 | 2026-10-30 | 7e85393 | Capabilities upgrade while their operations are open; resources are no longer limited to 1,024 operations; independent reconciliation. Breaking: a run’s admitting principal can no longer assert not_applied or partial for its own effects. |
v0.1.0-alpha.4 | 2026-10-30 | e8dbc6d | Holds left by a dead executor are released; MCP completion contracts. Breaking: runs belong to the principal that admitted them. |
v0.1.0-alpha.3 | 2026-10-29 | c6eebfb | A ten-minute path, hold inspection and a PostgreSQL failure drill. Breaking: task-authorization amendments that change issued_by or confirmation_ref count as widening. |
v0.1.0-alpha.2 | 2026-10-29 | 1e116b1 | Linux archives built against glibc 2.28. Breaking: effectful HTTP capabilities must declare recovery.completion, and effectful 4xx responses are unknown unless the manifest lists them as not applied. Tower approvals are bound to each capability’s risk; re-review agents approved under alpha.1. |
v0.1.0-alpha.1 | 2026-10-26 | 472edcc | First public alpha. Its Linux contextosd needs glibc 2.38 and does not start on older systems such as Ubuntu 22.04; use alpha.2. |
Releases are prereleases with signed provenance; published tags and assets are never replaced. Corrections ship as a new alpha.
Reading older pages
Pages on this site published before 2026-10-26 predate the public runtime and describe only the specification and its TypeScript reference. Their statements about “this repository” remain accurate for this site’s repository. For what a running system enforces today, use the runtime repository’s guide and the release notes above.