ragleap-core v0.13.0 release notes

ragleap-core v0.13.0

Stricter by default: documents are untrusted content for actions

Answers built from your ingested documents now count as untrusted content. A run that follows one starts as tainted, so outbound actions (webhook, Slack, email, CRM update, calendar, MCP, page fetch) need owner approval even in full autonomy mode. This is the same rule that already applied after a page fetch, an MCP call or a file read (#1190).

Why: an ingested document (an email attachment, a synced folder) can carry hidden instructions. If you control every document you ingest and want the old behaviour, set TAINT_RETRIEVED_DOCUMENTS=false. The semi and off modes are unchanged.

Stress Office: a test of the guardrails

A small open harness, benchmarks/stress_office/, that runs hidden-instruction events against the real guardrails (allowlists, taint rule, approval gate, step cap, budget). It has a scripted model that always obeys, a real-model mode with a hard token cap, and a positive control so that "the model ignored it" can be trusted (#1188, #1199, #1216, #1225, #1236, #1239, #1241).

The report is in docs/stress-office.md: on two real models, 100 counted injection runs, none followed the hidden instruction. It is a small test with simple injections, not a security certification, and the report says so. The harness found the document issue above and a crash on empty model replies (below), and we found and fixed mistakes in the harness itself before publishing.

Also in this release

Cheaper Inference as a supported LLM provider (#1173, thanks @aiapienthusiast), with a privacy caution in the README (#1179).
Fix: an OpenAI-compatible model that answers with no text no longer crashes the call; it uses the same fallback as the Gemini and Anthropic paths (#1226).
Fix: examples/01_ingest_and_query.py now sends the API key, and the README says how to ask a first question (#1201).
The Windows installer with the Ollama option was tried by one community tester (thanks @Anurag07-crypto, #781, #1215).
Test setup: httpx listed for the root tests (#1220).

Upgrade notes

No database change. Rebuild the app image.
If you use full autonomy, expect more approval requests after answers built from your documents.

Known limits

Single-tenant. Single sign-on has been tested on Keycloak for sign-in and refusals only, not on Entra ID or Okta. The offline install has not been tried on an air-gapped machine. The Windows installer with Ollama has one community test on one machine; macOS and Linux desktops are not verified. Not independently security reviewed.