0.14.0 — Codex connected apps and Devin store plugins

0.14.0 — Codex connected apps and Devin store plugins

A Codex BOM now lists the connected apps that a plugin declares, as MCP
components. A Devin BOM now composes store plugins from their cache copies, and
Devin policy evidence goes through the library boundary. openaca.core exports
the vulnerability gate matcher, so a consumer matches advisories as the gate
does.

Highlights

• Codex connected apps are MCP components. The scanner reads the apps
  file of a Codex plugin manifest. Each app reference is a plugin-owned
  mcp_server with the codex-app transport. Its openaca:codex_app_id holds
  the native app ID, such as connector_… or plugin_asdk_app_…. Its
  openaca:codex_app_namespaces holds the runtime namespaces that Codex's
  schema-4 tool cache binds to that ID, joined by exact ID. A missing or
  malformed binding is a composition gap. The design is in
  docs/specs/codex-agent-kind.md, "Connected app declarations".
• A remotely installed Codex plugin keeps its marketplace identity. The
  scanner reads .codex-remote-plugin-install.json and validates the remote
  plugin ID with the character set that Codex accepts (ASCII letters and
  digits, -, _ and ~). Before, a remote install without a registered
  marketplace lost its identity.
• Devin store plugins are composed from the cache (ADR-0080). A local, git
  or account-upload store entry is realized from its cache root with the same
  bundle walk that a repository plugin uses. Its MCP servers are in the BOM. An
  entry that does not resolve stays presence-only and is an inventory gap
  (ADR-0079).
• Devin policy evidence. collect_policy_evidence(..., agent_kind="devin")
  collects Devin components, advisory matches and posture matches.
  POLICY_EVIDENCE_AGENT_KINDS includes devin. Devin's root is not
  relocatable (ADR-0071), so another target raises PolicyEvaluationError, as
  for Cursor.
• openaca.core exports the vulnerability gate matcher.
  matches_vulnerability_gate(gate, advisory) is the function that the
  evaluator calls. It matches a listed id against the advisory's id and
  aliases, then compares the severity floor. VulnerabilityGate normalizes and
  validates its floor when it is built, so "high" works and an unknown floor
  raises PolicyValidationError at once.
• openaca:marketplace_source_digest. A plugin with a valid marketplace
  source carries the SHA-256 of that source, normalized as admission matching
  normalizes it. A consumer can group plugins by source without the URL or the
  local configuration. A missing, invalid or credential-bearing source gives no
  digest.

Install

uv tool install openaca==0.14.0 or pip install openaca==0.14.0.

Compatibility

Pre-V0 — no back-compatibility hedging.

• openaca:schema_version bumps 0.6 → 0.7. 0.7 adds the
  openaca:codex_app_id, openaca:codex_app_namespaces and
  openaca:marketplace_source_digest component properties. The document shape
  is otherwise the 0.6 shape. openaca bom lint accepts stored 0.5 and
  0.6 documents.
• Codex BOMs gain components. Each connected app of a plugin is a new
  mcp_server component.
• Codex policy evidence can find more gaps. An enabled app with no
  namespace binding in Codex's tool cache is a gap. By default, a gap makes
  collect_policy_evidence raise PolicyEvaluationError. Pass
  allow_partial_inventory=True to receive the readable components and the
  gaps instead.
• The overlay record schema is unchanged.