ragleap-security v0.1.0 release notes

ragleap-security 0.1.0: tenant scopes, audit log, secrets, limits

First release. Small, auditable security primitives for the ragleap libraries. Standard library only. Not independently audited: docs/threat-model.md lists what is and is not defended.

Behaviour changes

None: this is the first release.

What's new

Scope, ScopeError, require_scope: immutable tenant scopes with an unambiguous key (covers, narrow, parse).
AuditLog, verify: an append-only, hash-chained JSONL audit log. Tamper-evident, not tamper-proof.
SecretStr, from_env, redact: secrets that do not print themselves, lookup by environment variable name, and a heuristic redactor.
check_size, check_json_shape, bounded_read, Deadline: hard limits for untrusted input.

Verified

101 tests pass on Python 3.10 (the VPS) and on Python 3.12 (the author's sandbox). The CI test job passes on Python 3.10, 3.11 and 3.12 (#907).
30 of 30 mutations are killed on Python 3.10 and 3.12 (scripts/mutation_check.py).
A wheel built locally before tagging contains only the five modules plus metadata (no tests, scripts or docs) and imports from a clean Python 3.10 virtual environment.
The wheel published on PyPI installs in a clean Python 3.10 virtual environment and imports from there (checked after publishing).
The wheel and sdist built locally before tagging have the same SHA-256 digests as the files published on PyPI (the build is reproducible here).

Not verified

Windows, and network file systems.
Tenant isolation end to end: nothing in a released package uses Scope yet (ragleap-memory is the first planned user and is not released).
The locks that protect the audit log under adversarial timing (the race tests are probabilistic).
No independent security review has been done.

Provenance

Tag ragleap-security-v0.1.0 (annotated) on merge commit 61514400f6218c5d9ec39277c223d2601fbe720e. Release PR #923; code in #907.
Release workflow run 40016023080, published 2026-10-23 20:02 UTC.
ragleap_security-0.1.0-py3-none-any.whl sha256 e3f31d3703d552cde53080e6d6c56cef733954d61deeaba586bdce48db53075d
ragleap_security-0.1.0.tar.gz sha256 5080d28294dde2f0f2543a863b31a4ab13da7357b1263f807c8455fd2e45dea9