ragleap-agents v0.5.0 release notes

ragleap-agents 0.5.0: sub-agents

Behaviour changes

None for existing code. Every addition is opt-in: a run behaves as in 0.4.1 unless you pass tainted=True or build a delegate tool. No existing public signature changed incompatibly (Agent.run gained a keyword-only tainted=False).

What's new

Agent.run(task, *, tainted=False) starts a run already tainted, so every outbound tool needs approval from the first step (#828).
Sub-agents (#827): make_delegate_tool(children, ...) hands a task to a named child agent and returns its short answer as an untrusted, fenced observation. Taint flows both ways (a child starts tainted if its parent was; a tainting child taints the parent). delegate_policy, Budget and MAX_DEPTH_CEILING set the limits per root run (#843, #849).
Children cannot pause for approval in this release: a child action that needs approval does not run, and the child's run stops with approval_not_available.
ragleap_agents.context.current_run() returns the run context of the current tool call.

Verified

All 208 tests pass on Python 3.10 on the VPS (main at c31ab4e). CI was green on Python 3.10, 3.11 and 3.12 for the delegate-tool change (#849) and for the release PR (#892).
The published 0.5.0 wheel installs in a clean Python 3.10 venv from PyPI and exposes make_delegate_tool, delegate_policy, Budget, MAX_DEPTH_CEILING and Agent.run(task, *, tainted=False).
A live delegation check with scripts/live_delegate.py (#890): Groq openai/gpt-oss-20b, native mode, 8 runs (4 tasks in 2 configurations, one run each, 44 requests). The parent delegated in 8 of 8 runs, the parent was tainted in 8 of 8, and send_message never ran (approvals were never granted). In 3 runs the parent proposed send_message after a child had read the note, and the taint rule held it for approval.

Not verified

Resistance to prompt injection through a sub-agent. Only 2 of the 8 live runs read the injected note without a prompt that asked for an action, and the model proposed no send in either. The 3 runs held for approval followed prompts that asked for a send, so they show the gate working, not an injected instruction being resisted. Two runs say nothing about real attacks.
The child-side stop (approval_not_available) has only been exercised with scripted models. In the live runs the child never proposed send_message.
2 of the 8 live runs stopped on a model reply the loop could not use (unparseable_reply, invalid_plan). This looks like the format intermittency seen before on this model, but two runs cannot confirm it.
One provider (Groq), one model, native mode only. No speed numbers exist.
Resuming a run that was saved by 0.4.x with 0.5.0 (the saved state gained fields) has not been tested.
The published 0.5.0 wheel has not been run on Python 3.11 or 3.12.

Provenance

Tag ragleap-agents-v0.5.0 (annotated) on merge commit 332b4c0bc21bb350d5a65cccfd2cef581e609ce9. Release PR #892; code in #828, #843 and #849; live-check script #890.
Release workflow run 39653944931 (success), published 2026-10-21 at 18:35 UTC.
ragleap_agents-0.5.0-py3-none-any.whl sha256 8961d9ff4c131313b899dd8907f68fa2fa7672dd642a5e0ff34cb6c992334712
ragleap_agents-0.5.0.tar.gz sha256 12a1204bbe0c88e9afb45c89ab5c11f59dde33b2851dedb022c032bdefaa14c0