Open source · Apache-2.0 · Deterministic agent governance
Context Stack
The deterministic harness for AI agents. Context Stack governs what an agent may discover, invoke, and send — with enforcement outside the model, and a sealed receipt for every audited decision.
Reference gateway
Run the proof from a clean clone.
Don't take it on trust. The reference gateway is open source. Clone it, install, set two throwaway environment variables, and run 22 conformance scenarios against a live local gateway — about ten minutes.
The suite has 22 scenarios, zero expected-fail, and a green CI gate. Runtime enforcement uses deterministic code and compiled policy (OPA/WASM), never a model, and every audited gateway decision emits a sealed, tamper-evident Ed25519 receipt bound to a hash of the policy that produced it.
Two limits worth stating plainly. The gateway governs what passes through it: an agent that does not speak MCP, a direct API call that bypasses it, and side channels are outside its control — it is a control point, not a network perimeter. And determinism is a runtime property: policy authoring, capability registration and intent-envelope issuance sit upstream of the enforcement path, not inside it.
Apache-2.0, open source, no account, no signup. AARM-aligned strict-determinism profile — all Core requirements (R1–R6) implemented and CI-verified; independent conformance review not yet undertaken.
Why now
The governance gap is operational.
Most teams can make an AI assistant useful. The harder problem is deciding what context it may trust, where data may move, where the system should run, and who approves action.
Who owns the facts?
Context gets stale, duplicated, or trapped in handover notes, tickets, chats, and individual memory.
Where may data go?
Prompts, embeddings, logs, tools, APIs, and vendors create data movement that ordinary project controls often miss.
Where should AI run?
Cloud, on-premise, edge, and hybrid choices need policy, sovereignty, and control reasoning before deployment.
Who approves action?
Models can interpret and propose. Deterministic systems must validate, authorize, execute, and log.
Guided entry point
Start with a three-question assessment.
No login, no tracking, no stored answers. The wizard routes the problem to the right part of the framework and gives you a prompt you can use through MCP or any AI assistant.
Four questions before operational authority
1. What are you trying to govern?
2. Which delivery mode are you in?
3. What do you need next?
How teams use it
Assess, map, apply, operate.
Context Stack is meant to sit before and during delivery. It gives teams a governance map before they choose tools or automate workflows.
Assess
Find weak ownership, stale context, unclear egress rules, missing runtime policy, or approval gaps.
Map
Route the issue to ContextOps, ContextBoundary, or Sthala; use Griha as a worked example of governed AI capabilities composed into a running system.
Apply
Turn the selected layer into delivery questions, control points, decision records, and review gates.
Operate
Use MCP to bring the framework into AI-assisted work while enforcement remains in deterministic systems.
Delivery modes
The framework works across AMS, waterfall, agile, and platform work.
Different delivery modes lose context in different ways. Context Stack gives each mode a governance path without pretending they operate the same way.
AMS / Run
Context decays after handover. Ownership disappears, runbooks drift, and operations rebuild from fragments.
Waterfall / Project
Context freezes too early. Requirements and design decisions can be stale before go-live.
Agile / Product
Context changes every sprint. Decisions live in ceremonies, tickets, chats, and people.
Platform / Engineering
Framework decisions must become policy checks, egress controls, runtime boundaries, and audit evidence.
Framework layers
One stack, four questions.
The layers are separate on purpose. Context ownership, data movement, runtime placement, and product delivery should not be collapsed into one control model.
-
ContextOps
How does an organization govern its AI context?
Ownership, lifecycle, freshness, roles, maturity, named practices, and context accountability.
-
ContextBoundary
Where is data allowed to go?
Egress Tier controls, vendor zones, jurisdictional profiles, approval paths, and audit boundaries.
-
Sthala
Where does the AI actually run?
Governed AI runtime placement under ContextBoundary, with deterministic execution constraints and approved egress boundaries.
-
Griha
How do governed AI capabilities become a running system?
Worked example of governed AI capabilities composed into a running system, with executable policy behind it.
ContextBoundary's reference gateway is an AARM-aligned strict-determinism profile — all Core requirements (R1–R6) implemented and CI-verified; independent conformance review not yet undertaken. It is verifiable from a clean clone, not a hosted service; read the standards alignment.
Trust boundary
Models propose. Systems authorize.
Prompt injection, unsafe automation, context contamination, and authority confusion are boundary problems. Better prompts help; deterministic boundaries decide.
Ungoverned AI flow
- User prompt
- LLM interpretation shares the trust boundary
- Tool, API, or system action follows model output
- Review and audit are reconstructed later
Context Stack flow
- Model interprets and proposes
- Context and egress policy are checked
- Deterministic systems authorize execution
- Human review and logs remain explicit
MCP access
The framework can enter the workflow.
MCP is not the framework. MCP is the access path that lets AI assistants consult the framework during delivery, assessment, and architecture review.
Use MCP for
- Routing a problem to the right stack layer.
- Running a first-pass governance assessment.
- Finding the right source documents.
- Creating delivery questions before implementation starts.
What this is not
Clear boundaries keep the framework honest.
Context Stack defines governance language, assessment paths, and architectural boundaries. It does not claim to replace implementation controls.
Not a compliance certificate
It helps structure evidence and decisions, but it does not certify an organization by itself.
Not an enforcement engine
Gateways, IAM, policy engines, egress controls, approvals, and runtimes enforce the rules.
Not a prompt library
Prompting is useful, but authority belongs in deterministic controls and explicit governance paths.
Not vendor-bound
The stack is designed to sit alongside existing cloud, on-premise, hybrid, and edge choices.
Resources
Use the framework as text, code, or machine-readable context.
People can read the framework and repository map. AI assistants can use llms.txt or the MCP endpoint to route questions into the right source.