Skip to content

Maqam v0.2.3 — exact-approval proof and launch kit

Choose a tag to compare

View all tags
@AjnasNB AjnasNB released this 16 Jul 13:31
v0.2.3
7a07d94

Maqam 0.2.3 — exact-approval proof and launch kit

Maqam is a compact MIT-licensed TypeScript governance layer for agent and workflow tool calls: policy before execution, approval bound to the exact call, and source-linked evidence behind recorded claims.

What changed

  • Added maqam demo approval and maqam demo approval --json, a deterministic real temporary-file flow that blocks changed input before execution, executes the exact approved write once, rejects replay, links evidence to a claim, and verifies cleanup.
  • Added regression tests for the approval request, canonical input scope mismatch, one-use consumption, replay rejection, evidence linkage, and deterministic CLI output.
  • Added a reproducible local governed-call overhead microbenchmark with raw output and explicit interpretation limits.
  • Published a five-minute quickstart, Why Maqam guide, dated comparison, enforcement-boundary diagram, public roadmap, technical article, launch plan, and factual Show HN author brief.
  • Added the source, captions, narration, poster, and proof stills for the 60-second Remotion demonstration. The release MP4 is generated from the real CLI JSON.

Try it

npm install maqam@0.2.3
npx -y maqam@0.2.3 demo approval

Machine-readable proof:

npx -y maqam@0.2.3 demo approval --json

Verification

  • 189 Node tests passed locally.
  • Clean external TypeScript consumer compilation passed.
  • Production npm audit: 0 known vulnerabilities.
  • Remotion project audit: 0 known vulnerabilities.
  • Public-package dry run: 50 files; video source and launch drafts excluded from the npm tarball.
  • Release commit: 7a07d944e79283dd8c27131c41896d59fbe31249.
  • GitHub Actions passed on Node.js 20, 22, and 24 before tagging.
  • The release MP4 fully decoded as H.264/AAC, 1920×1080, 30 fps, exactly 60.000 seconds. Audio measured -19.2 LUFS integrated with a -3.5 dBFS true peak.

See SHA256SUMS.txt for artifact hashes.

Important boundary

Maqam governs only calls routed through registered adapters. Current approval, trace, runtime, and evidence state is in-process. ApprovalQueue does not authenticate reviewer identity, restored state must come from trusted host storage, evidence links record provenance rather than semantic truth, and Maqam is not an operating-system sandbox or durable workflow engine.

Documentation

Compatibility

Maqam requires Node.js >=20.18.1. ProductLoop OS 0.2.0 already declares maqam:^0.2.2, so it accepts this patch without republishing ProductLoop packages.

License note

Maqam remains MIT-licensed. The repository-only Remotion rendering toolchain has separate upstream terms documented in LICENSE_AUDIT.md and demo/remotion/ASSET_PROVENANCE.md.

Assets 19
Loading