ragleap-agents 0.5.0: Sub-agents — 208 tests, 8 live runs, 0 breaking changes

Tag: ragleap-agents-v0.5.0 (332b4c0) — 2 commits to main since.

TL;DR: make_delegate_tool lets a parent delegate to children, with taint flowing both ways and hard limits. Opt-in only.

The design goal

No breaking changes. Every addition is opt-in.

Old code still works

agent.run("do X")

New opt-in flags

agent.run("do X", tainted=True) # #828

Agent.run gained only *, tainted=False — keyword-only, defaults to old behavior.

from ragleap_agents import make_delegate_tool, delegate_policy, Budget, MAX_DEPTH_CEILING

delegate = make_delegate_tool(
children={
"researcher": researcher_agent,
"analyst": analyst_agent
},
# limits per root run
)

parent = Agent(tools=[delegate, send_message, ...])
result = parent.run("Research competitor pricing and draft a note")

Implementation in #827, #843, #849:

Child runs in isolated context (its own tools, budget)
Returns as untrusted, fenced observation — parent must treat as untrusted
Taint: if parent.tainted → child.tainted=True, if child.tainted → parent.tainted=True
Budget: Budget + MAX_DEPTH_CEILING cap depth and cost per root run

Why fenced? To prevent prompt injection via child answer becoming parent's instructions.

This is intentional for safety. No privilege escalation from child to parent approval queue.

Future: explicit child approval queue with owner confirmation on host (Phase 2 permission system).

from ragleap_agents.context import current_run

def my_tool(x: str):
ctx = current_run()
print(ctx.run_id, ctx.taint)
return x

Useful for custom logging / policy.

Verified (with numbers)

208 tests pass on Python 3.10 (VPS c31ab4e), CI green on 3.10/3.11/3.12
Wheel: exposes make_delegate_tool, delegate_policy, Budget, MAX_DEPTH_CEILING, Agent.run(..., tainted=False)
Live: scripts/live_delegate.py #890
- Provider: Groq openai/gpt-oss-20b, native mode
- 8 runs (4 tasks × 2 configs)
- Delegation: 8/8
- Tainted: 8/8
- send_message blocked: 8/8 (approvals never granted)
- Taint gate held: 3 runs proposed send after child read note → held for approval

Not verified — honest

Injection resistance: 2/8 read injected note unprompted → no send. Not enough for claim.
Child stop path tested only with scripted models in live runs.
2/8 runs failed on unparseable_reply / invalid_plan — same format intermittency as 0.4.x
No benchmarks, no 3.11/3.12 runtime check on published wheel, no resume test for 0.4.x saves.

We ship honest limits, not marketing.

Install & Provenance

pip install ragleap-agents==0.5.0

Digests: