0.14.5 — Local Codex marketplaces no longer stop policy matching

0.14.5 — Local Codex marketplaces no longer stop policy matching

A Codex plugin from a local marketplace now matches a policy, and two file
walks read less.

Highlights

• A local marketplace path no longer stops marketplace matching. Codex
  records a local marketplace as a path, not a URL. A marketplace target in a
  policy now does not match that plugin, and the evaluator still applies its
  exact plugin identifiers and its category default. Before, the path raised
  an error and policy evaluation of that inventory failed.
• The manifest-name index and the skill walk read only the files they use.
  The manifest-name index reads package.json and pyproject.toml and does not
  enter dependency directories. The project skill walk reads SKILL.md only.
  Results do not change. Collection reads fewer files in a large home directory.
• The mutable-reference check and the MCP parser share one uv option walker.
  A value-taking uv flag is skipped the same way in both.

Install

uv tool install openaca==0.14.5 or pip install openaca==0.14.5.

Compatibility

Pre-V0 — no back-compatibility hedging.

• A marketplace target does not match a plugin from a local marketplace.
  The plugin follows its exact identifiers and the category default.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.14.4 — Internal cleanup

0.14.4 — Internal cleanup

This release removes duplicated helpers and an unused re-export. Scans, BOMs,
policy evaluation and the CLI do not change.

Highlights

• Shared helpers replace three private copies. The Cursor evidence code
  reuses the Cursor resolver's extension tuples, and the skill posture rule
  reuses the shared set of agent kinds that recognize an exec. Each gives the
  same result as the copy it replaces.
• tools.component_ref no longer re-exports purl_type_for_ecosystem.
  Nothing imported it from there.

Install

uv tool install openaca==0.14.4 or pip install openaca==0.14.4.

Compatibility

Pre-V0 — no back-compatibility hedging.

• Nothing changes for a consumer. openaca.core does not change.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.14.3 — Internal cleanup

0.14.3 — Internal cleanup

This release removes a duplicated helper and an unused re-export. Scans, BOMs,
policy evaluation and the CLI do not change.

Highlights

• The plugin install walker reuses the component name helper. It kept its
  own copy of the scan-output name lookup. Both callers now use
  component_name_for on ComponentRef, which gives the same names.
• tools.component_ref no longer re-exports
  is_unpinned_mcp_package_launch. Nothing imported it from there. The
  helper stays in tools.identity, its only caller.

Install

uv tool install openaca==0.14.3 or pip install openaca==0.14.3.

Compatibility

Pre-V0 — no back-compatibility hedging.

• Nothing changes for a consumer. openaca.core does not change.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.14.2 — Internal cleanup

0.14.2 — Internal cleanup

This release removes a duplicated helper. Scans, BOMs, policy evaluation and
the CLI do not change.

Highlights

• The pyproject.toml parser reuses the shared PyPI name normalizer. It
  called a private copy of the PEP 503 normalizer. It now calls
  normalize_pypi_name in tools.mcp_launch_resolve, which gives the same
  result.

Install

uv tool install openaca==0.14.2 or pip install openaca==0.14.2.

Compatibility

Pre-V0 — no back-compatibility hedging.

• Nothing changes for a consumer. openaca.core does not change.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.14.1 — Claude marketplace sources from the native registry

0.14.1 — Claude marketplace sources from the native registry

An endpoint scan found the marketplace source of an installed Claude plugin
only when Claude settings declared that marketplace. Most marketplaces are
added with /plugin marketplace add, which records them in Claude's own
registry, not in settings. So most installed plugins had no source. This
release reads that registry too.

Highlights

• Installed Claude plugins get their marketplace source from
  plugins/known_marketplaces.json. In endpoint mode, a marketplace that
  settings do not declare is looked up by its exact key in that file, under
  the selected Claude configuration root. A registration in settings still
  takes precedence, also when it is malformed or unsupported. A missing,
  invalid, credential-bearing or ref-qualified source stays unmatched. The
  scanner never infers a source from a marketplace name. On one maintainer
  endpoint, 17 of 17 installed plugins now carry
  openaca:marketplace_source_digest, against 4 of 17 in 0.14.0.

Install

uv tool install openaca==0.14.1 or pip install openaca==0.14.1.

Compatibility

Pre-V0 — no back-compatibility hedging.

• More Claude plugins match a marketplace source. An admission entry that
  names a marketplace source now also matches a plugin from a marketplace that
  only Claude's registry records. Before, such a plugin fell to the default.
• A malformed known_marketplaces.json is a scan warning. The plugin then
  has no source. The scan continues.
• Repository mode, Cursor, Codex and Devin are unchanged.
• openaca:schema_version stays 0.7. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.14.0 — Codex connected apps and Devin store plugins

0.14.0 — Codex connected apps and Devin store plugins

A Codex BOM now lists the connected apps that a plugin declares, as MCP
components. A Devin BOM now composes store plugins from their cache copies, and
Devin policy evidence goes through the library boundary. openaca.core exports
the vulnerability gate matcher, so a consumer matches advisories as the gate
does.

Highlights

• Codex connected apps are MCP components. The scanner reads the apps
  file of a Codex plugin manifest. Each app reference is a plugin-owned
  mcp_server with the codex-app transport. Its openaca:codex_app_id holds
  the native app ID, such as connector_… or plugin_asdk_app_…. Its
  openaca:codex_app_namespaces holds the runtime namespaces that Codex's
  schema-4 tool cache binds to that ID, joined by exact ID. A missing or
  malformed binding is a composition gap. The design is in
  docs/specs/codex-agent-kind.md, "Connected app declarations".
• A remotely installed Codex plugin keeps its marketplace identity. The
  scanner reads .codex-remote-plugin-install.json and validates the remote
  plugin ID with the character set that Codex accepts (ASCII letters and
  digits, -, _ and ~). Before, a remote install without a registered
  marketplace lost its identity.
• Devin store plugins are composed from the cache (ADR-0080). A local, git
  or account-upload store entry is realized from its cache root with the same
  bundle walk that a repository plugin uses. Its MCP servers are in the BOM. An
  entry that does not resolve stays presence-only and is an inventory gap
  (ADR-0079).
• Devin policy evidence. collect_policy_evidence(..., agent_kind="devin")
  collects Devin components, advisory matches and posture matches.
  POLICY_EVIDENCE_AGENT_KINDS includes devin. Devin's root is not
  relocatable (ADR-0071), so another target raises PolicyEvaluationError, as
  for Cursor.
• openaca.core exports the vulnerability gate matcher.
  matches_vulnerability_gate(gate, advisory) is the function that the
  evaluator calls. It matches a listed id against the advisory's id and
  aliases, then compares the severity floor. VulnerabilityGate normalizes and
  validates its floor when it is built, so "high" works and an unknown floor
  raises PolicyValidationError at once.
• openaca:marketplace_source_digest. A plugin with a valid marketplace
  source carries the SHA-256 of that source, normalized as admission matching
  normalizes it. A consumer can group plugins by source without the URL or the
  local configuration. A missing, invalid or credential-bearing source gives no
  digest.

Install

uv tool install openaca==0.14.0 or pip install openaca==0.14.0.

Compatibility

Pre-V0 — no back-compatibility hedging.

• openaca:schema_version bumps 0.6 → 0.7. 0.7 adds the
  openaca:codex_app_id, openaca:codex_app_namespaces and
  openaca:marketplace_source_digest component properties. The document shape
  is otherwise the 0.6 shape. openaca bom lint accepts stored 0.5 and
  0.6 documents.
• Codex BOMs gain components. Each connected app of a plugin is a new
  mcp_server component.
• Codex policy evidence can find more gaps. An enabled app with no
  namespace binding in Codex's tool cache is a gap. By default, a gap makes
  collect_policy_evidence raise PolicyEvaluationError. Pass
  allow_partial_inventory=True to receive the readable components and the
  gaps instead.
• The overlay record schema is unchanged.

0.13.2 — Internal cleanup

0.13.2 — Internal cleanup

This release removes unused and duplicated internal code. Scans, BOMs, policy
evaluation and the CLI do not change.

Highlights

• Unused and duplicated helpers are removed. The unused
  tools.parsers.claude_plugin.parse_at_install_root helper is gone. Endpoint
  scans call walk_plugin_root directly, as before. The BOM linter reuses the
  property map helper in tools.bom. The Skillspector observation source
  reuses the bom-ref helper of the skill posture rule.

Install

uv tool install openaca==0.13.2 or pip install openaca==0.13.2.

Compatibility

Pre-V0 — no back-compatibility hedging.

• tools.parsers.claude_plugin.parse_at_install_root is removed. It was
  an internal helper with no caller. openaca.core does not change.
• openaca:schema_version stays 0.6. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.13.1 — Cursor plugin skills follow the manifest

0.13.1 — Cursor plugin skills follow the manifest

0.13.0 opened collect_policy_evidence to Cursor. A Cursor plugin that declares
a skills field still got the wrong skill inventory and a false inventory gap.
A gap makes collect_policy_evidence raise PolicyEvaluationError by default.
This release makes the inventory match what Cursor loads.

Highlights

• A Cursor plugin's skills field replaces folder discovery. The
  scanner reads the field the way the Cursor CLI 2026.10.22-27dcf5f does.
  • "skills": "./custom-skills" loads that directory only. The scanner no
    longer also scans skills/.
  • "skills": [] loads no skills. It no longer records an inventory gap.
  • In a list, an entry that names no directory is skipped. The other entries
    still load, and no inventory gap is recorded.
  • Devin keeps its own rule. One invalid entry stops all skill loading, and
    the scanner records a gap.

Install

uv tool install openaca==0.13.1 or pip install openaca==0.13.1.

Compatibility

Pre-V0 — no back-compatibility hedging.

• Cursor BOMs can lose skill components. A Cursor plugin that declares a
  skills field no longer lists the skills in its skills/ folder.
• Cursor policy evidence fails less often. The three manifest shapes above
  no longer raise PolicyEvaluationError for an inventory gap.
• Claude Code, Codex and Devin are unchanged.
• openaca:schema_version stays 0.6. The BOM document shape did not
  change.
• The overlay record schema is unchanged.

0.13.0 — Cursor policy evidence through the library boundary

0.13.0 — Cursor policy evidence through the library boundary

openaca.core.collect_policy_evidence collected evidence for Claude Code and
Codex only. This release adds Cursor. A Cursor hook that enforces policy on MCP
calls can now read its decisions through the same library boundary. Discovery
already composed Cursor, so the change opens the agent-kind gate and guards the
Cursor root.

Highlights

• Cursor policy evidence. collect_policy_evidence(..., agent_kind="cursor")
  collects Cursor components, advisory matches and posture matches through the
  same library boundary as Claude Code and Codex.
  • Cursor has no relocatable configuration root (ADR-0054). Omit target, or
    pass <home>/.cursor.
  • Another Cursor target raises PolicyEvaluationError before discovery.
    Before, discovery ignored the target and the call returned the evidence of
    the home directory.
  • The selector changes collection only. openaca policy compile still
    compiles Claude-managed settings.
• POLICY_EVIDENCE_AGENT_KINDS. openaca.core exports the agent kinds that
  collect_policy_evidence accepts. A consumer reads this set to find out if
  the installed release supports a kind. It does not need a trial call.

Install

uv tool install openaca==0.13.0 or pip install openaca==0.13.0.

Compatibility

Pre-V0 — no back-compatibility hedging.

• Additive. agent_kind="cursor" raised PolicyEvaluationError before. It
  now returns evidence. Claude Code and Codex collection is unchanged.
• openaca:schema_version stays 0.6. The BOM document shape did not
  change.
• The overlay record schema is unchanged.
• Internal helpers removed. tools.osv_federation.collect_target_purls and
  the unused include_gitignored parameter of the graph builder's ignore
  context are gone. Neither was part of openaca.core. Scan output is
  unchanged.

0.12.0 — Codex policy evidence through the library boundary

0.12.0 — Codex policy evidence through the library boundary

openaca.core.collect_policy_evidence collected evidence for Claude Code only.
This release adds Codex. A caller selects the agent, and the collector reads that
agent's own configuration graph. A runtime caller can also evaluate the readable
components when the inventory is incomplete, and get the gaps reported back.

Highlights

• Codex policy evidence. collect_policy_evidence(..., agent_kind="codex")
  collects Codex components, advisory matches and posture matches through the
  same library boundary as Claude Code.
  • The default stays "claude-code". An unsupported agent kind fails before
    discovery.
  • The selector changes collection only. openaca policy compile still
    compiles Claude-managed settings.
  • target=None uses the selected agent's default configuration discovery.
• Partial inventory for runtime callers.
  allow_partial_inventory=True evaluates the readable components when some
  inventory is missing. The result lists the missing coverage in
  inventory_gaps. The caller must report those gaps and apply its own
  uncertainty behavior to unresolved subjects.
  • Without the flag, an inventory gap still raises PolicyEvaluationError.
    openaca policy compile keeps strict collection.
  • An advisory collection failure raises in both modes.
• Endpoint posture stays separate from component admission. The collector
  passes each registered posture input channel to the rule runner. A Codex
  command-approval or project-trust finding has no component target, so it
  stays in unmapped_posture. Unreadable command-approval text does not block
  a component. It does not stop other admission decisions from updating.
• Codex profiles stay separate. Each Codex profile is its own inventory
  occurrence. Consumers must keep the ambiguity. They must not treat the union
  as one active launch configuration.
• Codex hook parsing fixes. A Codex plugin.json that wraps its inline
  hooks in the hooks file envelope now parses, with $.hooks.hooks locators.
  The hooks.state table in Codex config.toml holds trust and disablement
  records, so it is no longer read as a hook event.

Install

uv tool install openaca==0.12.0 or pip install openaca==0.12.0.

Compatibility

Pre-V0 — no back-compatibility hedging.

• PolicyEvidence has a new inventory_gaps field. It is an empty tuple
  unless the caller passes allow_partial_inventory=True.
• Codex endpoint BOMs can gain hook components. Inline hooks inside a
  plugin's hooks envelope were skipped before. A hooks.state table no longer
  yields an event. Claude Code BOMs are unchanged.
• openaca:schema_version stays 0.6. The BOM document shape did not
  change.
• The overlay record schema is unchanged.
• Internal parser signatures changed. hooks_json.parse_plugin_hooks and
  parse_plugin_hooks_inline no longer take plugin_name, which they never
  read. Hook identity stays the payload hash.