OpenWorkProof 1.5.0 — Experimental Codex Guard

OpenWorkProof 1.5.0

This release adds an experimental, separately activated Codex Guard to the existing
work-contract and verifiable-execution package. Existing MCP tools and stdio commands
remain available.

Codex preview-directory protection

owp-guard provides project installation, current-version review, a live allow/deny
probe, status inspection, guarded execution, and removal. Supported launches permit
reads and text additions or edits in the designated preview directory. Out-of-scope
paths, deletes, moves, arbitrary commands, and unsupported tools are rejected.

uv tool install 'openworkproof==1.5.0'
owp-guard install --project /absolute/site-project --allow-dir preview --human
owp-guard enable --project /absolute/site-project --human
owp-guard doctor --project /absolute/site-project --human
owp-guard run --project /absolute/site-project --prompt "Update the preview title" --human
owp-guard uninstall --project /absolute/site-project --human

The project and preview directory must already exist. enable asks the user to
review the current scope and runs a real probe using their existing Codex login and
usage allowance. A guarded launch supplies only the reviewed OWP hook's exact native
trust hash for that session; it does not bypass native hook trust or change global
Codex configuration.

Scope and evidence

Installing or connecting the MCP server does not enable Guard. Ordinary Codex windows
are not automatically protected. Guard is POSIX-only; live host checks covered macOS,
Python 3.12 and Codex CLI 0.147.0. Other host combinations need compatibility checks.

The supported task is a bounded, ephemeral run of at most 300 seconds. Arbitrary shell,
builds, tests, deployment, personal MCP/plugin configuration, and online search are
outside this launch path. Guard does not provide OS isolation, whole-computer
protection, content-correctness checks, or WorkBuddy/enterprise integration.

Local logs do not provide per-tool cryptographic session binding. completed is a
run/identity/observation result, not business acceptance; per_tool_session_proof
remains false. Scope, runtime, policy or host drift invalidates the current review
and probe.

The 1.5.0 version change is also bound to a new immutable candidate inventory built
from its frozen source revision. Historical candidate records are preserved.
Release checks, package publication and catalog publication are verified separately.

See activation,
runtime limits, and
MCP configuration.