ragleap-agents 0.5.0 如何加入子智能體並維持舊程式碼相容

ragleap-agents 0.5.0: Sub-agents — 208 tests, 8 live runs, 0 breaking changes

Tag: ragleap-agents-v0.5.0 (332b4c0) — 2 commits to main since.

TL;DR: make_delegate_tool lets a parent delegate to children, with taint flowing both ways and hard limits. Opt-in only.

The design goal

No breaking changes. Every addition is opt-in.

Old code still works

agent.run("do X")

New opt-in flags

agent.run("do X", tainted=True) # #828

Agent.run gained only *, tainted=False — keyword-only, defaults to old behavior.

1. make_delegate_tool — the new primitive

from ragleap_agents import make_delegate_tool, delegate_policy, Budget, MAX_DEPTH_CEILING

delegate = make_delegate_tool(
children={
"researcher": researcher_agent,
"analyst": analyst_agent
},
# limits per root run
)

parent = Agent(tools=[delegate, send_message, ...])
result = parent.run("Research competitor pricing and draft a note")

Implementation in #827, #843, #849:

• Child runs in isolated context (its own tools, budget)
• Returns as untrusted, fenced observation — parent must treat as untrusted
• Taint: if parent.tainted → child.tainted=True, if child.tainted → parent.tainted=True
• Budget: Budget + MAX_DEPTH_CEILING cap depth and cost per root run

Why fenced? To prevent prompt injection via child answer becoming parent's instructions.

1. Child approval model (v0.5.0 limit)

Child proposes send_message → needs approval

In 0.5.0: does NOT pause parent, stops with approval_not_available

This is intentional for safety. No privilege escalation from child to parent approval queue.

Future: explicit child approval queue with owner confirmation on host (Phase 2 permission system).

1. current_run()

from ragleap_agents.context import current_run

def my_tool(x: str):
ctx = current_run()
print(ctx.run_id, ctx.taint)
return x

Useful for custom logging / policy.

Verified (with numbers)

• 208 tests pass on Python 3.10 (VPS c31ab4e), CI green on 3.10/3.11/3.12

• Wheel: exposes make_delegate_tool, delegate_policy, Budget, MAX_DEPTH_CEILING, Agent.run(..., tainted=False)

• Live: scripts/live_delegate.py #890

  • Provider: Groq openai/gpt-oss-20b, native mode
  • 8 runs (4 tasks × 2 configs)
  • Delegation: 8/8
  • Tainted: 8/8
  • send_message blocked: 8/8 (approvals never granted)
  • Taint gate held: 3 runs proposed send after child read note → held for approval

Not verified — honest

• Injection resistance: 2/8 read injected note unprompted → no send. Not enough for claim.
• Child stop path tested only with scripted models in live runs.
• 2/8 runs failed on unparseable_reply / invalid_plan — same format intermittency as 0.4.x
• No benchmarks, no 3.11/3.12 runtime check on published wheel, no resume test for 0.4.x saves.

We ship honest limits, not marketing.

Install & Provenance

pip install ragleap-agents==0.5.0

Digests:

• whl: 8961d9ff4c131313b899dd8907f68fa2fa7672dd642a5e0ff34cb6c992334712
• tar.gz: 12a1204bbe0c88e9afb45c89ab5c11f59dde33b2851dedb022c032bdefaa14c0

Release PR #892, workflow 39653944931, 2026-10-21 18:35 UTC. Trusted publishing with Sigstore.

What's next

This unlocks Phase 3 of RagLeap roadmap:

• Lead agent that splits task → parallel children → citation merge
• Budget per child + cancellation
• Multi-provider live tests

Code: github.com/ragleap/ragleap-core

If you build multi-agent, try the delegation API and tell me where it breaks.