0.13.0 — Cursor policy evidence through the library boundary

0.13.0 — Cursor policy evidence through the library boundary

openaca.core.collect_policy_evidence collected evidence for Claude Code and
Codex only. This release adds Cursor. A Cursor hook that enforces policy on MCP
calls can now read its decisions through the same library boundary. Discovery
already composed Cursor, so the change opens the agent-kind gate and guards the
Cursor root.

Highlights

• Cursor policy evidence. collect_policy_evidence(..., agent_kind="cursor")
  collects Cursor components, advisory matches and posture matches through the
  same library boundary as Claude Code and Codex.
  • Cursor has no relocatable configuration root (ADR-0054). Omit target, or
    pass <home>/.cursor.
  • Another Cursor target raises PolicyEvaluationError before discovery.
    Before, discovery ignored the target and the call returned the evidence of
    the home directory.
  • The selector changes collection only. openaca policy compile still
    compiles Claude-managed settings.
• POLICY_EVIDENCE_AGENT_KINDS. openaca.core exports the agent kinds that
  collect_policy_evidence accepts. A consumer reads this set to find out if
  the installed release supports a kind. It does not need a trial call.

Install

uv tool install openaca==0.13.0 or pip install openaca==0.13.0.

Compatibility

Pre-V0 — no back-compatibility hedging.

• Additive. agent_kind="cursor" raised PolicyEvaluationError before. It
  now returns evidence. Claude Code and Codex collection is unchanged.
• openaca:schema_version stays 0.6. The BOM document shape did not
  change.
• The overlay record schema is unchanged.
• Internal helpers removed. tools.osv_federation.collect_target_purls and
  the unused include_gitignored parameter of the graph builder's ignore
  context are gone. Neither was part of openaca.core. Scan output is
  unchanged.