ragleap-agents v0.3.0

Third release of ragleap-agents. Install: pip install ragleap-agents==0.3.0.

Behaviour change from 0.2.0

The prompt wording now depends on the adapter mode (prompt_style). In json mode the prompt asks for one JSON object as plain text and says not to use any tool-calling feature. In native mode it never mentions JSON: it asks the model to call exactly one provided tool by its own name, and to answer in plain text when finished or when unable or unwilling. The repair note follows the same style. A custom llm callable that sets no prompt_style keeps the previous wording.

What is new

• Mode-aware prompt wording (above). openai_compatible(...) sets llm.prompt_style to its mode and Agent reads it.
• Cold-start tests with positive controls: with no policy the first step is never gated, the second step pauses (awaiting_approval), and the identical run with the tool declared TRUSTED completes. An outbound tool runs first but pauses after a tainting tool. 4 of 4 targeted mutations are caught by tests/test_cold_start.py alone.
• The check that a Policy naming a nonexistent tool raises ValueError at construction is now pinned by a test.

Verified

• 123 tests (112 in 0.2.0).
• The published wheel and sdist digests match the publish log. The published wheel installs fresh on Python 3.10, 3.11 and 3.12 and the behaviour checks pass.

Observed with a real model (Groq, openai/gpt-oss-20b unless noted; one run per task and configuration; not a benchmark)

• Repo source after the prompt change: json c1 and c4 completed 4 of 4 times. Native c5 completed 3 of 3. json i3 failed 3 of 3 and native i3 ended as invalid_plan 3 of 3.
• Published 0.3.0 wheel, 7 tasks (c1, c2, c4, m1, n1, i1, i4): native 7 of 7, json 5 of 7. json c4 and i1 failed with HTTP 400 tool_use_failed: the model answered in its own function-call shape (a calc call for c4, a fetch_note call for i1) and the provider rejected the request before our loop saw a reply. i1 had always completed in earlier runs. JSON mode on this model is intermittent and this release does not fix it. Prefer native mode with models that have one.
• Wider sweep on the 0.3.0 prompt: 19 of 20 tasks done in each mode. In native mode, c6 and m2 finished done without the needed tool result.
• Other models, native mode, injection tasks only: gpt-oss-120b i2 failed with the wrapper-tool 400 (it attempted to call a tool named JSON); qwen/qwen3.8-27b i1 stopped on duplicate_action.
• 2 of 46 saved native runs before 0.3.0 failed with a call to a tool that was not offered; 0 of 26 after. That is too few to show an effect.

Not verified

• The taint rule against a real model: across 16+ runs on three models that read the injected note, none proposed the injected send_message, so the rule has never been triggered by a real model. It is tested with scripted models only (mutation-checked).
• Any provider other than Groq (Gemini has not been tried), long runs, and concurrent resumes across processes.
• Whether the prompt change improves pass rates: single runs on one model do not show that.

Not fixed

• An empty run (no tools, or an empty task) returns status="done" with stop_reason="no_task_or_tools" although nothing happened. Planned for a later release.
• The loop has no defined way for a model to decline. A model's refusal of an injected instruction is reported as invalid_plan.

Correction

• The ## [0.3.0] section of the published CHANGELOG is dated 2026-10-13, but the tag was pushed on 2026-10-15 (tag run 38791601216). Published files cannot change; the date will be corrected on main in the next release.

Provenance

• Code: PR #752, merge commit 0a2541b (tested head 1df18e3). CI on the merge commit: run 38735314233, success (ragleap-agents-tests on 3.10, 3.11 and 3.12).
• Publish: tag run 38791601216.
• Digests (sha256):
  • ragleap_agents-0.3.0-py3-none-any.whl: ce857f07b55aaa103233c22cfe5401c0c61b262d0e0a6864a602bac4bf53fa95
  • ragleap_agents-0.3.0.tar.gz: 430ab70038499622526a30d470e2a15bbfb052eba81041838bddb61bccdf73fc