SynapCores Community Edition v2.3.2-ce

Community Edition · free · seamless upgrade from v2.2.0-ce

Governed autonomy, end to end: role-based access control for your agents, on a database that learns from outcomes and proves every decision.

v2.3.2 is the release that makes the complete governed-autonomy story safe to hand to a team. It adds database-scoped role-based access control for every autonomous operation, role-bound expiring API keys, and database ownership — and it pairs them with a 47-finding correctness pass that converts a batch of previously-silent edge cases into either correct results or honest, explicit refusals.

It also brings the full DAVINCI line forward onto :latest: agents that learn from verified outcomes, a tamper-evident decision ledger, vector search that scales beyond RAM, native Ollama compatibility, and grounded questions over live operational data. One engine for SQL, graph, vectors, memory, inference, and governed agents — with autonomy off by default.

New in v2.3.2

1. Agent RBAC — decide who can monitor, operate, approve, and configure your agents

Outcome: make the in-database agent platform safe to give to a team.

Autonomy without access control is a non-starter for a team. v2.3.2 adds database-scoped agent privileges, separate from ordinary data permissions:

• Roles, in SQL. CREATE ROLE, GRANT / REVOKE (role membership and per-database agent privileges), SHOW ROLES / SHOW GRANTS. Four predefined, immutable templates — agent_monitor, agent_operator, agent_approver, agent_admin — plus your own custom roles. Separation of duties is real: an approver cannot lend data-write rights to a read-only operator.
• Role-bound, expiring, database-scoped API keys. Create a key bound to roles and a database scope (exact names or the dynamic owned selector), with an expiry. Revocation is never cached — every agent dispatch re-checks the live credential.
• Database ownership. A CREATEDB principal creates and administers its own databases; GET /v1/auth/whoami?database=<db> reports the caller's effective rights.
• Creator-bound execution + a decision audit. A goal keeps its creator's credential and spending ceiling; every agent decision persists an audit receipt (principal, key, role, privilege, database, allow/deny). Work is fenced to the database generation it started in, so a dropped-and-recreated database cannot inherit stale authority.

Now in the console, not just REST: a new Agent Roles & Grants admin screen, role / database / expiry bindings on the API-key manager, a reject-step action with privilege-aware errors in the Learning Loop console, and the Learning Loop console itself (goals, plans, approvals, policy, config).

2. A 47-finding correctness hardening pass

Outcome: fewer silent wrong answers, and honest errors where a feature isn't supported.

A systematic review repaired real edge cases and — just as importantly — removed false successes, where a call used to return HTTP 200 while doing nothing.

Now correct:

• Binary (BYTEA / BLOB) round-trips and matches — arbitrary bytes survive insert, scan, SELECT, and WHERE col = X'…', joins, IN, GROUP BY, and DISTINCT without loss. DECIMAL and JSON conversions preserve their values.
• Joins and derived tables — similarity predicates in a JOIN ON now return the same rows as the equivalent WHERE, and two derived tables that share a column name join on the right keys.
• Triggers inside transactions — a BEFORE trigger whose rule aborts an update now returns a clear, specific error instead of a blanket refusal, so trigger-guarded writes behave predictably under transactions.
• SELECT DISTINCT deduplicates grouped / aggregate results; vector search applies filters before top-k pruning with one dot-product convention across scalar, SIMD, and tiered paths.
• Graph is database-scoped. Graph nodes and relationships now belong to the database they were created in, and database-scoped keys see only their own database's graph — the same boundary your relational data already honored. (Cross-tenant graph data was always isolated.)
• Single-hop graph scans and CREATE DATABASE both fixed — the Web-UI schema view (MATCH ()-[r]->()) no longer stalls on large graphs; a new AIDB_GRAPH_PATH_RESULT_CAP tunes the multi-hop fan-out cap without penalizing simple hops.
• Real backup artifacts + validated logical restore; ML evaluation decodes predictions through stored label mappings and requires an explicit target; RAG context is bounded; filesystem collections reconcile renames.

Now fail-closed (honest, not silent): point-in-time recovery, backup schedules / policies / clone / import / export, cluster data replication, MySQL KILL, SELECT INTO, BY NAME set operations, computed generated columns, and multipart-SQL file upload now return an explicit 501 / refusal instead of a false success.

Upgrade note: these paths never actually worked — removing their false success is the fix. If an application relied on a 200 from one of them, it was a no-op; switch to the supported path (the release page lists each one). Recover original data or DDL from a trusted source where an old silent marker had already lost it.

3. Console and SQL-surface polish

• Type-aware integer formatting (no more 1.0000 for an integer), a normalized Query Editor toolbar, and expanded SQL docs + editor autocomplete (HNSW / FULLTEXT / MATCH … AGAINST, ANOMALY_SCORE, COVAR_POP / COVAR_SAMP / CORR).
• SHOW ROLES / SHOW GRANTS render as structured tables in the console.
• CREATE GOAL is documented in the runtime SQL manual, so MCP clients can discover it.

Also included — the full DAVINCI line, now on :latest

These capabilities debuted in the DAVINCI development line and are now generally available. Autonomous learning remains off by default until you explicitly enable it per goal or persona.

Agents that improve from verified outcomes

Define a goal and a deterministic success check. SynapCores executes it, records the result, and updates an online policy from verified outcomes — within your tenant, never sent to an external model vendor. Promotion of a learned policy requires separate held-out evidence. Controls: off by default, explicit approval before any write (pending writes leave rows unchanged), per-goal spending limits, and a kill switch that survives restarts. Entry points: CREATE GOAL, EXECUTE GOAL, SHOW AGENT GOALS|POLICY|EPISODES, PAUSE|RESUME GOAL, and AGENT_RUN(persona, task, JSON_OBJECT('learn', true, …)).

Prove what your agents did

Every recorded decision, reward, and policy change enters an append-only, cryptographically hash-linked ledger, and the engine verifies the full agent and episode history — individual record lineage, not just the latest entry. A hash-linked ledger provides tamper evidence; regulatory compliance and resistance to a privileged attacker require additional controls such as access restrictions, external anchoring, and independent retention.

Grow your vector corpus without growing RAM at the same rate

The elastic HNSW vector store keeps hot vectors resident and pages the rest from durable storage within a configured memory budget — relational data, graph, and embeddings stay in one engine. Verified: a corpus at 1.5× the memory budget ran across 3 tenants and 64 checkpoints with zero out-of-memory failures; SQL and vector-search latency stayed within ±6% of the prior release.

Keep your Ollama clients and existing AI workflows

Native Ollama API compatibility, tested with ollama-python, LangChain Ollama, and LlamaIndex embeddings — redirect supported clients without rebuilding their integration layer. Includes request queuing for concurrent /api/generate, correct 404s for missing collections, safe handling of null generation options, and corrected reservation when num_gpu: 0.

Ask questions of your operational data, with evidence

Ask a question scoped to a database; SynapCores uses the live schema and rows to answer, and returns the generated SQL and retrieved evidence alongside it. Stronger selected-source grounding, readable file citations (e.g. filesystem:orbit_support/troubleshooting-error-codes.md#0), and tool failures that no longer masquerade as answers. General chat no longer invokes database or RAG tools by default — tool use is opt-in per turn. Grounding reduces unsupported answers; it does not eliminate model errors.

More accurate, up-to-date agent memory

CREATE MEMORY matches vector dimensions to the selected embedding model (including 768-dim models such as nomic-embed-text), and memory supersession respects chronology — a newer fact replaces an older one rather than stale history taking precedence. Existing 384-dim stores reopen unchanged.

A better default model for RAG and agents

New deployments default to qwen2.5:7b, a general instruction-following model chosen for RAG grounding and tool-calling over the prior coding-focused default; the coder model remains available and operator-pinnable, and explicit [query.ai_service].model choices are unaffected. Verified to download, load, and generate on a CPU-only host without AVX-512.

Less time configuring and repairing deployments

Automatic GPU detection with continued CPU-only support; installer improvements that reconcile stale service drop-ins, support NVIDIA device nodes, and preserve customer-owned configuration during uninstall. Existing memory and vector stores remain readable with no on-disk format change. ML recipes 002, 004, 005, 006, and 007 run end to end.

Install or upgrade

docker pull synapcores/community:v2.3.2-ce
# or GHCR:
docker pull ghcr.io/synapcores/community:v2.3.2-ce

Or use the installation script:

curl -fsSL https://get.synapcores.com/install-ce.sh | sh

Release binaries are available for Linux x86_64, Linux aarch64, and macOS Apple Silicon. This is a drop-in upgrade from v2.3.1 — no on-disk format change. Back up production data before upgrading.

Validated for this release: state-asserting feature validator green (316 / 0) on a pristine volume against the published image; agent-RBAC acceptance (whoami, role / key creation, 403 contract, step reject); binary-equality, trigger-in-transaction, join-correctness, and backup-roundtrip regressions; graph database-isolation checks; and a non-AVX-512 runtime canary that loads a model and runs an embedding with no illegal-instruction fault.

Community Edition. No separate AI stack required.

One database for SQL, graph, vectors, memory, inference, and governed agents. Govern who can do what. Learn from verified outcomes. Keep control of every action. Prove the history. Agent RBAC, the learning loop, and the full SQL / graph / vector / agent surface are all included in CE — free to self-host, autonomous learning off by default until you turn it on.