ProductLoop OS v0.2.1 — Maqam companion ecosystem

ProductLoop OS 0.2.1 — Maqam companion ecosystem

ProductLoop OS is the modular TypeScript layer around Maqam: runtime composition, policy, approvals, provenance, evaluations, connectors, skills, and bounded browser research. Maqam remains the exact input-bound execution and evidence kernel.

Install and verify

npm install productloop-os@0.2.1
npx productloop-os@0.2.1 doctor --json

Watch the 55-second narrated ecosystem overview.

Published package set

Package	Version	Role
productloop-os	0.2.1	Umbrella composition and CLI doctor
ajnas-runtime	0.2.1	Workflow runtime primitives
ajnas-skills-registry	0.2.1	Explicit skill registration
ajnas-provenance	0.1.3	Evidence and provenance records
ajnas-policy	0.1.2	Policy decisions and limits
ajnas-evals	0.1.2	Deterministic evaluation fixtures
ajnas-connectors	0.1.2	Provider-neutral connector contracts
ajnas-approvals	0.1.2	Approval coordination primitives
ajnas-browser-research	0.1.3	Bounded research and citation records

Verified release

• Exact release commit: 30c82e6ea6c2c039cf09d8c0bfbb41caf6171dc8
• npm publication: Trusted Publishing workflow run 29597785941
• CI: Node 20, 22, and 24 run 29595598838
• CodeQL: JavaScript/TypeScript run 29595598132
• Test suite: 128 tests plus builds, type checks, integration, clean-consumer compilation, CLI doctor, and package dry-runs
• Security checks: zero npm audit vulnerabilities; registry signatures and npm provenance attestations verified after a clean external install
• Canonical Linux manifest SHA-256: 342bce4c26b3bf1ebb18989965d332f3f7250a16486e0da7fa1139bcc727024a
• Every attached package tarball is byte-identical to the independently downloaded npm artifact

Security model

The publish job is manual, verifies an approved commit and manifest, and receives its short-lived npm identity only after maintainer approval in the protected npm-publish environment. It publishes the eight leaf packages first and the umbrella package last, then re-downloads and verifies every artifact.

Boundaries

ProductLoop OS is a library ecosystem, not a hosted control plane, model provider, secret manager, production browser, or universal security boundary. Applications remain responsible for routing every relevant side effect through the configured gateway, provider authentication, network and operating-system isolation, durable storage, retries, rate limits, reviewer identity, and deployment monitoring.