ragleap-core v0.13.1

ragleap-core v0.13.1

A small release. The only change in the app is a new structured audit log; everything else is documentation and CI.

What changed in the app

• Structured audit log lines (#1278). Every agent action now also writes one JSON line on the ragleap.audit logger, starting with AUDIT : action_proposed, action_executed, action_error, action_rejected, action_skipped and action_forced_approval. Each line has a UTC time, the action type, channel, role, target (cut to 200 characters), who approved or rejected it (name, role, kind), an action_id that links a proposal to its decision, and a sha256 of the content and of the result. The text itself is never written. A log shipper can keep these lines.
• Turn the lines off with AUDIT_LOG_LINES=false.

Upgrade notes

• No schema change, no new route, no new dependency. Rebuild and restart the app.
• The lines go to the app's log output only. How long they are kept depends on your own log setup. They do not make an installation compliant with any law or standard.
• Not covered yet: GET reads, chat routes, per-step events of agent runs, the case where an approved action's send fails, and a retention or purge setting for the database tables.

Documentation

• SECURITY.md refreshed: supported versions, scope, honest limits (#1276).
• New operator guides: a security incident runbook (#1277) and a host time synchronisation guide (#1290).
• GitHub Pages site fixed: the build, the README rendering and links that gave 404 (#1285, #1286, #1289).

CI

• terraform init retries up to 3 times when GitHub returns a 504 (#1296).

Thanks

Thanks to Paige Ortiz (CerTova AI) for the technical review that prompted the audit and documentation work, and to everyone who tested and reported. Contributors are credited by name; tell us if you prefer not to be.