0.12.0 — Codex policy evidence through the library boundary

0.12.0 — Codex policy evidence through the library boundary

openaca.core.collect_policy_evidence collected evidence for Claude Code only.
This release adds Codex. A caller selects the agent, and the collector reads that
agent's own configuration graph. A runtime caller can also evaluate the readable
components when the inventory is incomplete, and get the gaps reported back.

Highlights

• Codex policy evidence. collect_policy_evidence(..., agent_kind="codex")
  collects Codex components, advisory matches and posture matches through the
  same library boundary as Claude Code.
  • The default stays "claude-code". An unsupported agent kind fails before
    discovery.
  • The selector changes collection only. openaca policy compile still
    compiles Claude-managed settings.
  • target=None uses the selected agent's default configuration discovery.
• Partial inventory for runtime callers.
  allow_partial_inventory=True evaluates the readable components when some
  inventory is missing. The result lists the missing coverage in
  inventory_gaps. The caller must report those gaps and apply its own
  uncertainty behavior to unresolved subjects.
  • Without the flag, an inventory gap still raises PolicyEvaluationError.
    openaca policy compile keeps strict collection.
  • An advisory collection failure raises in both modes.
• Endpoint posture stays separate from component admission. The collector
  passes each registered posture input channel to the rule runner. A Codex
  command-approval or project-trust finding has no component target, so it
  stays in unmapped_posture. Unreadable command-approval text does not block
  a component. It does not stop other admission decisions from updating.
• Codex profiles stay separate. Each Codex profile is its own inventory
  occurrence. Consumers must keep the ambiguity. They must not treat the union
  as one active launch configuration.
• Codex hook parsing fixes. A Codex plugin.json that wraps its inline
  hooks in the hooks file envelope now parses, with $.hooks.hooks locators.
  The hooks.state table in Codex config.toml holds trust and disablement
  records, so it is no longer read as a hook event.

Install

uv tool install openaca==0.12.0 or pip install openaca==0.12.0.

Compatibility

Pre-V0 — no back-compatibility hedging.

• PolicyEvidence has a new inventory_gaps field. It is an empty tuple
  unless the caller passes allow_partial_inventory=True.
• Codex endpoint BOMs can gain hook components. Inline hooks inside a
  plugin's hooks envelope were skipped before. A hooks.state table no longer
  yields an event. Claude Code BOMs are unchanged.
• openaca:schema_version stays 0.6. The BOM document shape did not
  change.
• The overlay record schema is unchanged.
• Internal parser signatures changed. hooks_json.parse_plugin_hooks and
  parse_plugin_hooks_inline no longer take plugin_name, which they never
  read. Hook identity stays the payload hash.