04 · Field guide
CFA — Context Fabric Appliance
A bounded execution envelope for AI coding agents.
What it does
An AI coding agent with shell access is an unbounded actor. The Context Fabric Appliance puts a deterministic gateway in front of it: every capability the agent may use is declared in a manifest, and every action outside the manifest is denied and receipted.
The trial build runs entirely locally and makes no host-level changes — no daemons installed, no system paths rewritten. It is designed so a security reviewer can evaluate it on a laptop.
Denied-action receipts matter as much as allowed ones: they are the record that the boundary held.
Who it’s for
Security engineers and platform owners evaluating agent containment.
What you need
- ·macOS on Apple Silicon (Linux amd64 build also published)
- ·Signed, checksummed evaluation build
- ·Trial mode; no account required
Quick start
# macOS (Apple Silicon) — install & run$ curl -LO https://github.com/Intelligent-Context-AI-Inc/cfa-releases/releases/latest/download/cfa-release-2-enterprise-gateway-preview-macos-arm64-0.2.1.zip$ unzip cfa-release-2-enterprise-gateway-preview-macos-arm64-0.2.1.zip && cd cfa-release-2-enterprise-gateway-preview-macos-arm64-0.2.1$ ./bin/cfa initialize --trial-mode --accept-license
Signed, checksummed evaluation build.
Linux amd64 build and full verification steps (Ed25519 signature, checksums) on the release page.
Step by step
- 01
Download the signed build
Fetch the latest evaluation archive for your platform from the releases page.
$ curl -LO https://github.com/Intelligent-Context-AI-Inc/cfa-releases/releases/latest/download/cfa-release-2-enterprise-gateway-preview-macos-arm64-0.2.1.zip - 02
Verify before you run it
The release page publishes Ed25519 signatures and checksums. Verify them — this is exactly the habit the appliance exists to enforce.
- 03
Initialize in trial mode
Trial mode activates a time-bounded enterprise gateway tier with a single seat and installs nothing outside the unpacked directory.
$ ./bin/cfa initialize --trial-mode --accept-license - 04
Point an agent at the gateway
Route your coding agent through the appliance and watch the manifest allow, deny, and receipt each action.
What you’ll see
By continuing, you accept the CFA External Evaluation License for this local trial.{ "mode": "trial", "status": "active", "expires_at": "...", "license_terms": "CFA External Evaluation License", "tier": "enterprise_gateway", "seat_count": 1}
If something goes wrong
macOS refuses to open the binary.
The build is signed; clear the quarantine attribute or approve it once in system settings after verifying the checksum.
The trial reports as expired.
Trial activations are time-bounded. Download the latest release and initialize again.