ragleap-agents 0.5.0: sub-agents

ragleap-agents 0.5.0: sub-agents

Behaviour changes

None for existing code. Every addition is opt-in: a run behaves as in 0.4.1 unless you pass tainted=True or build a delegate tool. No existing public signature changed incompatibly (Agent.run gained a keyword-only tainted=False).

What's new

• Agent.run(task, *, tainted=False) starts a run already tainted, so every outbound tool needs approval from the first step (#828).
• Sub-agents (#827): make_delegate_tool(children, ...) hands a task to a named child agent and returns its short answer as an untrusted, fenced observation. Taint flows both ways (a child starts tainted if its parent was; a tainting child taints the parent). delegate_policy, Budget and MAX_DEPTH_CEILING set the limits per root run (#843, #849).
• Children cannot pause for approval in this release: a child action that needs approval does not run, and the child's run stops with approval_not_available.
• ragleap_agents.context.current_run() returns the run context of the current tool call.

Verified

• All 208 tests pass on Python 3.10 on the VPS (main at c31ab4e). CI was green on Python 3.10, 3.11 and 3.12 for the delegate-tool change (#849) and for the release PR (#892).
• The published 0.5.0 wheel installs in a clean Python 3.10 venv from PyPI and exposes make_delegate_tool, delegate_policy, Budget, MAX_DEPTH_CEILING and Agent.run(task, *, tainted=False).
• A live delegation check with scripts/live_delegate.py (#890): Groq openai/gpt-oss-20b, native mode, 8 runs (4 tasks in 2 configurations, one run each, 44 requests). The parent delegated in 8 of 8 runs, the parent was tainted in 8 of 8, and send_message never ran (approvals were never granted). In 3 runs the parent proposed send_message after a child had read the note, and the taint rule held it for approval.

Not verified

• Resistance to prompt injection through a sub-agent. Only 2 of the 8 live runs read the injected note without a prompt that asked for an action, and the model proposed no send in either. The 3 runs held for approval followed prompts that asked for a send, so they show the gate working, not an injected instruction being resisted. Two runs say nothing about real attacks.
• The child-side stop (approval_not_available) has only been exercised with scripted models. In the live runs the child never proposed send_message.
• 2 of the 8 live runs stopped on a model reply the loop could not use (unparseable_reply, invalid_plan). This looks like the format intermittency seen before on this model, but two runs cannot confirm it.
• One provider (Groq), one model, native mode only. No speed numbers exist.
• Resuming a run that was saved by 0.4.x with 0.5.0 (the saved state gained fields) has not been tested.
• The published 0.5.0 wheel has not been run on Python 3.11 or 3.12.

Provenance

• Tag ragleap-agents-v0.5.0 (annotated) on merge commit 332b4c0bc21bb350d5a65cccfd2cef581e609ce9. Release PR #892; code in #828, #843 and #849; live-check script #890.
• Release workflow run 39653944931 (success), published 2026-10-21 at 18:35 UTC.
• ragleap_agents-0.5.0-py3-none-any.whl sha256 8961d9ff4c131313b899dd8907f68fa2fa7672dd642a5e0ff34cb6c992334712
• ragleap_agents-0.5.0.tar.gz sha256 12a1204bbe0c88e9afb45c89ab5c11f59dde33b2851dedb022c032bdefaa14c0

v0.11.0

First release under the ragleap organisation (the repository moved from antonyrag/ragleap-core; old links redirect).

New in the app

• Documents tab: list, upload and delete documents. Deleting also removes the document's entries from the knowledge graph. (#710, #711)
• 28 file types and web pages by address can be added from the dashboard. (#720)
• Proactive and Connectors tabs in the AI Office. (#740)
• Offline language detection: LANGUAGE_DETECTION_MODEL=lite works without internet. (#741)
• Safer container: the app runs as a non-root user with pinned dependencies. (#742)
• One scheduler: only one process runs the background jobs, so extra web workers no longer repeat scheduled triggers. (#817)
• New provider: DemonRoute, 20 providers in total. (#851)
• Windows install: clearer steps and the direct one-line command. (#700, #701, #702)

Computer control, first slices (experimental, off by default)

Folders can be shared with AI employees only by a command run on the machine (ragleap files). A sandbox runner reads them read-only. AI employees can list and read files and can ask for access, which always needs the owner's approval and grants nothing by itself. File contents stay out of the activity log, and the Files tab shows the grants. ragleap files off pauses everything. (#747, #776, #777, #789, #790, #791, #792)

It has not been independently reviewed. Please do not switch COMPUTER_CONTROL on for real data. Reviewers are welcome: #800.

Community

Testing issues (#779 to #787), number words for every language (#801) and the ragleap-phone RFC (#814). Thank you to @sammist2, @mig-builds, @ahmet-izgi and @haterfactory for their contributions.

Upgrade notes

• The container now runs as user 10001. The app writes no files of its own, so the standard setup needs no change.
• Packages (ragleap-rag, ragleap-graph, voice, agents and others) have their own versions and changelogs.

Known limits

• The compose file still ships a public default password for the graph database (Neo4j listens on localhost only). A random password per install is planned.
• Tested by the maintainer on one Windows laptop and on Linux servers. macOS, Linux desktops and the Ollama option on Windows are not verified yet (issues #779 to #781).
• No named users or roles yet, and no independent security review yet.

ragleap-ops 0.6.0

Changed

• The app and voice image defaults, in the Helm values and in the raw k8s/ manifests, now point to ghcr.io/ragleap/ragleap-app:0.11.0, the image that this repository's publish-image workflow builds and publishes. They pointed to ghcr.io/antonyrag/ragleap-app:latest, a package under a different account whose latest tag was last updated on 2026-08-30 and is not published by the workflow.
• The default tag is 0.11.0 (a pinned version, so installs do not change when a new image is published).

Upgrade note

• The ragleap-app package under ragleap was private when this was written (2026-10-20). The ghcr-pull-secret that the chart references must hold credentials with read access to that package, or the app and voice pods will stay in ImagePullBackOff. To keep the old image, set app.image and voice.image yourself.

Known limitations

• CI scales app and voice to zero, so those pods were not run against the chart with the new image. What was checked: the Helm render differs from 0.5.2 only in the two image lines, helm lint passes, and the wheel contains the chart and the manifests.

Verified on PyPI: the 0.6.0 wheel has 26 files under helm/; 21 files under k8s/; and the project Source URL is https://github.com/ragleap/ragleap-core/tree/main/packages/ragleap-ops

pip install ragleap-ops==0.6.0

ragleap-agents v0.4.1

Patch release of ragleap-agents. Install: pip install ragleap-agents==0.4.1.

Changed

• Project links in the package metadata (Homepage, Repository, Issues) now point at https://github.com/ragleap/ragleap-core, the repository's new home in the ragleap organization.
• The OpenAI-compatible adapter's default User-Agent header now names the new address (ragleap-agents (+https://github.com/ragleap/ragleap-core)); it named the old owner before.
• Nothing else changed. This release is the 0.4.0 tag plus those links and the version string. Work that is on the main branch but unreleased (the tainted argument of Agent.run and the sub-agent building blocks) is not in it and will come in the next minor release.

Verified

• The differences from the 0.4.0 tag are five files: the version string, the README status line, the CHANGELOG, the project links in pyproject.toml and the DEFAULT_USER_AGENT constant. 151 tests pass on Python 3.10 with that content.
• The published 0.4.1 wheel differs from the published 0.4.0 wheel only in ragleap_agents/__init__.py (the version), ragleap_agents/providers.py (the single DEFAULT_USER_AGENT line) and the .dist-info folder (compared with diff -rq on the unpacked wheels).
• The published wheel and sdist digests match the publish log and PyPI (below).
• The published wheel installed into a fresh virtual environment on Python 3.10, run from outside the repository: pip check clean, the version is 0.4.1, the default User-Agent shows the new address, and an empty run returns status="stopped" with stop_reason="no_task_or_tools".
• The merge-back pull request (#863), which carries this release plus the current main branch, had no failing or pending checks when it was last looked at.

Not verified

• CI did not run on the tagged commit itself: the workflow runs for pushes to main and for pull requests into main, and this tag points at a commit on a release branch cut from the 0.4.0 tag.
• The published wheel was not installed on Python 3.11 or 3.12 for this release.
• The changed User-Agent string was not tried against a live provider. Only the address inside it changed; Groq's gateway rejected Python's default User-Agent in an earlier test, which is why the adapter sends its own.
• Unchanged since 0.4.0: the prompt wording was not touched, so the real-model results of 0.3.0 stand and were not re-run. JSON mode on the model tested is still intermittent, and the taint rule has still never been triggered by a real model.

PyPI notice

• PyPI shows a "Change of provenance" banner on this release. Its detail lists the repository as the only difference: 0.4.0 was published from antonyrag/ragleap-core and 0.4.1 from ragleap/ragleap-core, the repository's new location. It was published by the repository's trusted-publishing workflow (run 39379150990, below).
• PyPI verified the attestations of both files: publishing platform GitHub Actions, repository ragleap/ragleap-core, commit 0a61e87, workflow .github/workflows/release.yml at that commit, run 39379150990. The signatures are in the public Sigstore transparency log (entries 3332184103 for the sdist and 3332186149 for the wheel). Releases 0.1.0 to 0.4.0 show full provenance on PyPI.

Provenance

• Release branch commit 0a61e87 (tag ragleap-agents-v0.4.1), cut from the 0.4.0 tag plus the link changes from commit 9c6075b; merge-back pull request #863.
• Publish: tag run 39379150990, trusted publishing with attestations; the log shows the upload, with no "skipping" line, so this was the first upload.
• Digests (sha256), identical on PyPI and in the run log:
  • ragleap_agents-0.4.1-py3-none-any.whl: 61717b1a52f5bfe2b0a74548931a030d87b688a07948f49975b54dee43834806
  • ragleap_agents-0.4.1.tar.gz: df59328616e678478b916d731616e2f2d0eda856d6b72182ae263d96acc621d4

ragleap-vectorstores v0.5.2

Metadata-only release of ragleap-vectorstores. Install: pip install ragleap-vectorstores==0.5.2.

Changed

• Project links in the package metadata (Homepage, Repository, Issues) and the roadmap link in the README now point at https://github.com/ragleap/ragleap-core, the repository's new home in the ragleap organization. No code changed. The 0.5.1 project page on PyPI still shows the old owner; GitHub redirects the old links.

Verified

• The published 0.5.2 wheel differs from the published 0.5.1 wheel only in the __version__ line of ragleap_vectorstores/__init__.py and in the .dist-info folder (compared with diff -rq on the unpacked wheels). The only commit touching this package between the 0.5.1 tag and this release is the link update.
• CI on the release PR (run 39318858976): the ragleap-vectorstores tests passed on Python 3.10 and 3.12. CI on the merge commit completed successfully.
• The published wheel and sdist digests match the publish log and PyPI (below). This is the first release published through the repository's new location, ragleap/ragleap-core, and the upload succeeded.

Not verified

• A fresh install and import of the published 0.5.2 wheel, and any real backend round trip against it, were not run for this release (the code is identical to 0.5.1, which was).
• The Redis tests were not run on the maintainer's server for this release (its Redis test container was absent); they ran in CI, which starts its own Redis. The live OpenSearch and Upstash tests skip in CI by design and were not re-run.

Provenance

• Release PR #858, merge commit 4652191.
• Publish: tag run 39319327125, trusted publishing with attestations; the log shows both files uploaded, with no "skipping" line, so this was the first upload.
• Digests (sha256), identical on PyPI and in the run log:
  • ragleap_vectorstores-0.5.2-py3-none-any.whl: cab1c7038f556568a7964e7f7427213310ef3d4cbffdfde12f412955a35f3f90
  • ragleap_vectorstores-0.5.2.tar.gz: 688c3a54f595fd0ff58beeab730a47e995ef61b72002f8e270f840f322f6533f

PyPI notice

• PyPI shows a "Change of provenance" banner on this release. Releases up to 0.5.1 were published from antonyrag/ragleap-core; 0.5.2 was published from the repository's new location, ragleap/ragleap-core, so PyPI reports that the repository that created this release differs from a previous release. It was published by the repository's trusted-publishing workflow (run 39319327125, above).

ragleap-tools v0.5.1

Metadata-only release: the project links in the package metadata now point at the ragleap organization repository (github.com/ragleap/ragleap-core), so the PyPI project page shows the new owner. No code change; the same 362 tests pass. See the package CHANGELOG.

ragleap-tools v0.5.0

Easy to extend, safe to dispatch. Standard library only; nothing that existed behaves differently. Added: the tool decorator (a type-annotated function becomes a Tool, schema from annotations and docstring, arguments validated before the function runs), Toolkit (named collection with select, three provider schema exports, and call() that never raises), default_toolkit(), ToolError, validate_arguments(), Tool.metadata and Tool.to_anthropic_schema(). 362 tests (162 new) on Python 3.10 and 3.12, mutation-tested (89 of 89 deliberate breaks caught). Not verified: that OpenAI, Gemini or Anthropic accept the generated schemas in a live tool-calling request. See the package CHANGELOG and docs/design/tool-authoring.md.

ragleap-terraform 0.1.1

Changed

• The project URLs on the package page (Source, Changelog, Issues) now point to github.com/ragleap/ragleap-core, where the repository moved from antonyrag/ragleap-core. No code or chart changes.

Verified on PyPI: the 0.1.1 wheel has 4 files under modules/; and the project Source URL is https://github.com/ragleap/ragleap-core/tree/main/packages/ragleap-terraform

pip install ragleap-terraform==0.1.1

ragleap-ops 0.5.2

Changed

• The project URLs on the package page (Source, Changelog, Issues) now point to github.com/ragleap/ragleap-core, where the repository moved from antonyrag/ragleap-core. No code or chart changes.

Verified on PyPI: the 0.5.2 wheel has 26 files under helm/; 21 files under k8s/; and the project Source URL is https://github.com/ragleap/ragleap-core/tree/main/packages/ragleap-ops

pip install ragleap-ops==0.5.2

ragleap-observability 0.8.4

Changed

• The project URLs on the package page (Source, Changelog, Issues) now point to github.com/ragleap/ragleap-core, where the repository moved from antonyrag/ragleap-core. No code or chart changes.

Verified on PyPI: the 0.8.4 wheel has 17 files under helm/; and the project Source URL is https://github.com/ragleap/ragleap-core/tree/main/packages/ragleap-observability

pip install ragleap-observability==0.8.4