RagLeapragleap-core v0.13.1 was published on 2026-11-09. It is a small release: the only change in the app is a structured audit log, and everything else is documentation and CI. Source: the v0.13.1 release notes.
What are the structured audit log lines?
Every agent action now also writes one JSON line on the ragleap.audit logger, starting with AUDIT. The events are action_proposed, action_executed, action_error, action_rejected, action_skipped and action_forced_approval. Each line has a UTC time, the action type, the channel, the role, the target (cut to 200 characters), who approved or rejected it (name, role and kind), an action_id that links a proposal to its decision, and a sha256 of the content and of the result. The text itself is never written. A log shipper can keep these lines.
How do I turn it off?
Set AUDIT_LOG_LINES=false.
What should I know before upgrading?
- No schema change, no new route and no new dependency. Rebuild and restart the app.
- The lines go to the app’s log output only. How long they are kept depends on your own log setup.
- They do not make an installation compliant with any law or standard.
What is not covered yet?
- GET reads and chat routes.
- Per-step events of agent runs.
- The case where an approved action’s send fails.
- A retention or purge setting for the database tables.
What else is in the release?
- Documentation:
SECURITY.mdrefreshed with supported versions, scope and honest limits (#1276); a security incident runbook (#1277); a host time synchronisation guide (#1290). - The GitHub Pages site was fixed: the build, the README rendering and links that gave 404 (#1285, #1286, #1289).
- CI:
terraform initretries up to 3 times when GitHub returns a 504 (#1296).
The release notes thank Paige Ortiz (CerTova AI) for the technical review that prompted the audit and documentation work, and everyone who tested and reported. More: our release page and the roadmap.