ProductLoop OS v0.2.3 — release-truth patch

Umbrella-only documentation and release-integrity patch.

• Corrects the public release state shown on npm.
• Adds a trusted Ubuntu preparation workflow for canonical Linux tarball identities.
• Keeps all eight leaf package versions unchanged; the protected publisher verified their exact registry hashes and provenance and skipped them.
• Supports Node.js 22 LTS, 24 LTS, and 26 Current.
• Published through npm Trusted Publishing with SLSA provenance.

Verified umbrella identity:

• Commit: dbc1605
• Tarball: productloop-os-0.2.3.tgz
• SHA-256: 34e99ed6ce53d5632e6043ddc31826c5d46ca22c37773803b49b58b67ef16a21
• npm integrity: sha512-p4GibES2i5RlaNn+iXi4v8JwM5o08ZjFNii1YKZw9KsiMV09gg0RFCjXJWhkf4Hz0D1wHa8KC4rYpWJbrKkVkA==

The protected run verified all nine package artifacts, both dependency audits, registry signatures, and a joint clean installation.

ProductLoop OS v0.2.2 — Node 22/24/26 and Maqam 0.3.1

ProductLoop OS 0.2.2

A coordinated Node 22/24/26 release of the ProductLoop companion ecosystem around Maqam.

Published packages

• ajnas-runtime@0.2.2
• ajnas-skills-registry@0.2.2
• ajnas-provenance@0.1.4
• ajnas-policy@0.1.3
• ajnas-evals@0.1.3
• ajnas-connectors@0.1.3
• ajnas-approvals@0.1.3
• ajnas-browser-research@0.1.4
• productloop-os@0.2.2

Release boundary

• Exact source commit: 30cf16f8320d2fd2bfd24c640e8c328cee90d769
• Supported Node lines: 22, 24, and 26
• Default Maqam integration: maqam@0.3.1
• Compatibility floor retained and tested: exact maqam@0.2.4
• Published leaf-first through npm Trusted Publishing with SLSA provenance
• Registry tarball SHA-256 and sha512 integrity verified for every package
• Clean joint install: zero vulnerabilities, 39 verified signatures, 11 verified attestations

Verification run: https://github.com/AjnasNB/productloop-os/actions/runs/29702701632
Preparation PR: #23

ProductLoop OS v0.2.1 — Maqam companion ecosystem

ProductLoop OS 0.2.1 — Maqam companion ecosystem

ProductLoop OS is the modular TypeScript layer around Maqam: runtime composition, policy, approvals, provenance, evaluations, connectors, skills, and bounded browser research. Maqam remains the exact input-bound execution and evidence kernel.

Install and verify

npm install productloop-os@0.2.1
npx productloop-os@0.2.1 doctor --json

Watch the 55-second narrated ecosystem overview.

Published package set

Package	Version	Role
productloop-os	0.2.1	Umbrella composition and CLI doctor
ajnas-runtime	0.2.1	Workflow runtime primitives
ajnas-skills-registry	0.2.1	Explicit skill registration
ajnas-provenance	0.1.3	Evidence and provenance records
ajnas-policy	0.1.2	Policy decisions and limits
ajnas-evals	0.1.2	Deterministic evaluation fixtures
ajnas-connectors	0.1.2	Provider-neutral connector contracts
ajnas-approvals	0.1.2	Approval coordination primitives
ajnas-browser-research	0.1.3	Bounded research and citation records

Verified release

• Exact release commit: 30c82e6ea6c2c039cf09d8c0bfbb41caf6171dc8
• npm publication: Trusted Publishing workflow run 29597785941
• CI: Node 20, 22, and 24 run 29595598838
• CodeQL: JavaScript/TypeScript run 29595598132
• Test suite: 128 tests plus builds, type checks, integration, clean-consumer compilation, CLI doctor, and package dry-runs
• Security checks: zero npm audit vulnerabilities; registry signatures and npm provenance attestations verified after a clean external install
• Canonical Linux manifest SHA-256: 342bce4c26b3bf1ebb18989965d332f3f7250a16486e0da7fa1139bcc727024a
• Every attached package tarball is byte-identical to the independently downloaded npm artifact

Security model

The publish job is manual, verifies an approved commit and manifest, and receives its short-lived npm identity only after maintainer approval in the protected npm-publish environment. It publishes the eight leaf packages first and the umbrella package last, then re-downloads and verifies every artifact.

Boundaries

ProductLoop OS is a library ecosystem, not a hosted control plane, model provider, secret manager, production browser, or universal security boundary. Applications remain responsible for routing every relevant side effect through the configured gateway, provider authentication, network and operating-system isolation, durable storage, retries, rate limits, reviewer identity, and deployment monitoring.

ProductLoop OS v0.2.0

ProductLoop OS 0.2.0 ships the governed agent toolkit as nine verified public packages.

Highlights:

• Runtime, skills registry, provenance, policy, evals, connectors, approvals, browser research, and the productloop-os umbrella.
• Maqam 0.2.2 bridge and productloop-os doctor / productloop-os demo CLI flows.
• Exact approval binding, stable canonicalization, provenance verification, and hardened object-boundary validation.
• 124 workspace tests, nine typechecks, clean external TypeScript consumer, audits, and Node 20/22/24 CI.

Start here:

npm install productloop-os@0.2.0
npx productloop-os doctor --json
npx productloop-os demo

Use the component packages directly only when you need a smaller surface.

Release-proof assets

• ProductLoop release-proof video
• SHA-256 checksums

ProductLoop OS 0.1.1

Public npm release with a verified clean-consumer TypeScript dependency graph. Includes governed runtime composition, policy, approvals, provenance, evaluations, connectors, skills, browser research, and the Maqam crawler bridge. CI passes on Node.js 20, 22, and 24.