Download Free CE

SynapCores v1.12.0 — Encrypt the audit ledger at rest, and prove it was never touched

Published on July 26, 2026

SynapCores v1.12.0 — Encrypt the audit ledger at rest, and prove it was never touched

A compliance reviewer looking at an autonomous agent asks three questions:

  1. What did it do?
  2. Can you prove that record wasn't altered?
  3. Was it ever readable at rest?

SynapCores already answered the first two — every agent run is recorded automatically and hash-chained, so an edit is detectable. v1.12.0 answers the third, and hardens the second.

Encrypt the ledger

Immutable audit tables can now be encrypted at rest with AES-256-GCM:

CREATE IMMUTABLE TABLE agent_decisions (
  decision_id INTEGER PRIMARY KEY,
  ts          TIMESTAMP,
  file        TEXT,
  action      TEXT,
  rationale   TEXT
) WITH (ENCRYPTION='AES256GCM');

Both copies are encrypted — the row-engine table that serves your SELECTs and the append-only block chain behind VERIFY. Grep the data directory and your plaintext isn't there. The master key comes from the environment (AIDB_IMMUTABLE_MASTER_KEY), never the disk and never the binary.

And it's fail-closed: a missing key, a wrong or omitted ENCRYPTION algorithm, or a CREATE IMMUTABLE ... AS SELECT are rejected — never silently downgraded to a plaintext table. You cannot accidentally ship an unencrypted audit log.

Prove it wasn't touched — for real

VERIFY TABLE and VERIFY RECORD now walk the actual chain — per-record checksum, per-block checksum and merkle root, and every block-to-block link — and cross-check the chained record count against what's in storage:

VERIFY TABLE agent_decisions;
-- is_valid=true | chain verified: N records, per-record lineage anchored (tamper-evident)

Edit a single byte on disk and is_valid flips to false. And the standing nightly control is one query:

SELECT COUNT(*) FROM _system_agent_runs WHERE verified = false;   -- expect 0

(WHERE on the system tables is now honored in the projection path, so that filter returns the right answer instead of every row.)

Runs on a stock CPU box

The crypto is runtime-CPU-gated, so the encrypted, tamper-evident ledger runs on a plain CPU-only container — no GPU, no special instruction set. We proved it: v1.12.0 was validated on a non-AVX-512 canary (an i5-10400F), booting with no illegal-instruction fault and running the whole path — create → insert → select (decrypts) → VERIFY → UPDATE rejected (append-only) → no plaintext on disk — out of the box.

Also in this release

  • Anonymous, opt-out telemetry. Install count, version, and deployment type only — never your data, queries, schemas, or credentials. Failure-isolated (never blocks the server) and off via synapcores telemetry disable, [telemetry] enabled = false, or DO_NOT_TRACK=1.
  • MySQL wire: TLS + port 3307. require_tls and STARTTLS; the listener defaults to 3307 so it runs next to an existing MySQL during a migration. Still off by default.
  • Correct version everywhere. The banner, --version, /version, /health, MCP, and the MySQL handshake now report the real release instead of a frozen 0.1.0.
  • New recipes. A complete coding-agent backend (memory + code RAG + a Cypher/GraphRAG call-graph impact query + an immutable decision log, on one self-hosted instance), plus agent decision-traceability recipes for loan underwriting and clinical decision support.

Get it

curl -fsSL https://get.synapcores.com/install.sh | sh
# or
docker pull synapcores/community:latest      # = v1.12.0-ce

Linux x86_64 / aarch64 (Ubuntu 22.04 + 24.04) and macOS (Apple Silicon). Full SQL reference at docs.synapcores.com.