Linux server

PROVEN in 0.4.0 on Linux x64 and Linux arm64 by executing the delivered archives. The desktop app remains macOS arm64; Linux/Windows desktop builds are compile-only.

Distribution

context-control-plane-<version>-linux-x64.tar.gz (and -linux-arm64, -macos-arm64):

registry            Context Registry (control plane)
context             Context CI and Build tooling (validate, build, test, diff, regression, ci, artifact, sign, verify)
context-runtime     Standalone Context Runtime (--build DIR or --bundle DIR, --binding FILE)
ci/context-check.sh Pull-request check used by the GitHub workflow
bin/node            Official Node 24.21.0 for the platform (checksum verified against nodejs.org SHASUMS256)
lib/                Engine and SEIF runtime packages (pure JavaScript)
sdk/                Python (stdlib only) and TypeScript clients
distribution.json   Platform, entrypoints, Node provenance; SHA256SUMS for every file

Requirements: glibc 2.28+ (Debian 10+, Ubuntu 20.04+, RHEL 8+). Nothing else: no global Node, Go, .NET, SEIF CLI or source checkout. Python is needed only by applications that use the Python SDK.

tar -xzf context-control-plane-0.4.0-linux-x64.tar.gz && cd context-control-plane-0.4.0-linux-x64
sha256sum -c SHA256SUMS
SEIF_REGISTRY_TOKEN=… ./registry --data /var/lib/context-registry --port 4320 --config registry.json

Registry-managed deployments run on the same host as isolated processes (adapter isolated-process.v1). Put the Registry behind a TLS reverse proxy for remote clients; non-loopback runtimes require a token.

How it is proven

scripts/prove-linux.sh <linux-x64|linux-arm64> packages the archive, starts a python:3.12-slim-bookworm container on the target platform with --network none as user nobody, verifies that no Node or SEIF exists in the image, unpacks and checksum-verifies the archive, and runs proof/linux-acceptance.mjs with only the bundled Node: Registry; Build with the shipped CLI; HTTP and SQLite bindings; Registry-managed runtime deployment; /proc/<pid>/environ of the runtime (only the bound provider secret, no Registry secrets); a Python application on an application credential through the stable environment route; denied promotion/deployment/registration; provider provenance and dimensional trace search; exact reproduction with a retained provider result; Context CI PASS and BLOCK via the shipped check script; staging on a different binding with the same Build; a TypeScript application; rollback; a standalone runtime with a local binding; clean shutdown. The report records the executed architecture (x86_64 / aarch64), OS, glibc and the container image digest.

The x64 run executes the genuine x86-64 binaries under Docker Desktop's emulation on an Apple-silicon host: it proves Linux x64 compatibility and behavior, not x64 performance. Performance numbers in this repository are from macOS arm64.