DEVELOPER GUIDE

From first install
to a useful integration.

Start with a local memory write and retrieval. Then explore the API, runtime controls, deployment model, and the boundaries you should understand before using real data.

Python 3.10+HTTP API v1Self-hosted
01 / READ THIS FIRST

Which version should I use?

i

Published package and repository source are on different release stages.

PyPI: synapse-memory-engine==1.3.1 is the published SDK version documented for the quickstart.

Repository: the current source tree targets 1.4.0 and contains newer run-guard, trace, and provenance work. The 1.4.0 package has not yet been published to PyPI.

Do not expect 1.4.0-only APIs to exist when you install the published 1.3.1 package.

The repository source is licensed under Apache 2.0. The published PyPI 1.3.1 artifact predates that repository license migration; its original distribution terms were not changed retroactively. See the licensing policy.

02 / FIRST SUCCESSFUL WRITE + READ

Local quickstart

This path verifies that the engine can save and retrieve a memory on your machine. It uses SQLite and the built-in deterministic hash embedder. That embedder is not semantic; this is a plumbing/evaluation path, not a semantic retrieval quality test or production configuration.

1

Create a virtual environment

Python 3.10 or newer is required.

MACOS / LINUX
python -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install synapse-memory-engine==1.3.1
WINDOWS POWERSHELL
python -m venv .venv
.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip
python -m pip install synapse-memory-engine==1.3.1
2

Start the local engine

Open terminal 1 and keep it running.

MACOS / LINUX
export SYNAPSE_STORAGE_BACKEND=sqlite
export SYNAPSE_SQLITE_DB_PATH=./synapse_memory.db
python -m uvicorn synapse_memory.api.fastapi_server:app --host 127.0.0.1 --port 8008
WINDOWS POWERSHELL
$env:SYNAPSE_STORAGE_BACKEND = "sqlite"
$env:SYNAPSE_SQLITE_DB_PATH = "./synapse_memory.db"
python -m uvicorn synapse_memory.api.fastapi_server:app --host 127.0.0.1 --port 8008
Local-only configuration: in a fully unconfigured local setup, authentication is intentionally development-open. Do not expose this engine port to a network or use this configuration in production. Keep the generated .synapse_key safe and stable while the database exists.
3

Save and retrieve one memory

In terminal 2, with the same virtual environment active, run this script.

PYTHON · quickstart.py
from synapse_memory import SynapseClient, SynapseError

with SynapseClient(
    "http://127.0.0.1:8008",
    tenant_id="local-dev",
    timeout=10,
) as client:
    created = client.create_memory(
        "The project uses PostgreSQL in production and SQLite for local demos.",
        category="fact",
    )
    print(f"Created memory: {created.id}")

    result = client.retrieve("Which database is used for local demos?")
    print(result.fused_context or "(No context returned)")

    try:
        client.retrieve("")
    except SynapseError as exc:
        print(f"Request failed: {exc}; retryable={exc.retryable}")

Expected result: the script prints a memory ID and retrieved context containing the saved fact. If the context is empty, confirm that the engine is still running and inspect its terminal logs.

4

Check readiness and stop

In a third terminal, check the readiness endpoint.

TERMINAL
python -c "import urllib.request; print(urllib.request.urlopen('http://127.0.0.1:8008/readiness').read().decode())"

Stop the engine with Ctrl + C in terminal 1. Keep the local database and encryption key together if you want to reuse the data.

03 / SOURCE TREE FEATURE

Opt-in execution controls

The repository's 1.4.0 source includes SynapseRun and RunPolicy for work that an application explicitly routes through the guard. The guard can account for steps and tool calls, check a cooperative deadline, detect repeated failed calls, and record metadata-only events.

ILLUSTRATIVE SOURCE API · 1.4.0
from synapse_memory.runtime import RunPolicy, SynapseRun

policy = RunPolicy(
    max_steps=30,
    max_tool_calls=20,
    timeout_seconds=120,
    max_repeated_failures=2,
)

with SynapseRun(policy=policy) as run:
    result = run.call_tool(
        "lookup_customer",
        {"customer_id": "example-id"},
        lookup_customer,
    )
Important limits: this source API is not included in the published 1.3.1 package. Guards apply only to calls explicitly routed through SynapseRun; they do not intercept arbitrary framework/tool calls. Deadlines are cooperative and cannot forcibly interrupt a synchronous tool that is already running. A retry-safe flag is an application assertion, not proof of idempotency.

Applications supply their own postconditions for tool outcomes. Synapse records whether that supplied check passed or failed; it cannot independently prove that the check represents the user's real-world objective.

04 / SOURCE TREE FEATURE

Persistent run traces and retrieval evidence

The 1.4.0 source includes tenant-scoped run summaries and chronological event APIs. A run can be linked to retrieval evidence: memory IDs, ranks, allowlisted score metadata, token cost, packed/not-packed decisions, and provenance lineage.

POST/api/agent-runsCreate a run summary · agent-runs:write
POST/api/agent-runs/{run_id}/eventsAppend an event · agent-runs:write
GET/api/agent-runsList tenant-scoped runs · agent-runs:read
GET/api/agent-runs/{run_id}/eventsRead chronological events · agent-runs:read
DELETE/api/agent-runs/{run_id}Delete a run and its events · agent-runs:delete

The event contract is allowlisted and metadata-only. Raw prompts, queries, memory contents, tool arguments, and tool results are not part of the run event record. The dashboard provides a bounded inspector and redacted metadata export.

Reference: API contract · Memory provenance · Fault-injection evidence and limits.

05 / BEFORE REAL DATA

Production-shaped deployment

The SQLite quickstart is for local evaluation only. A production-shaped deployment needs PostgreSQL with pgvector, a real semantic embedding provider, stable encryption and API secrets, protected network access, and distinct database roles.

Deployment checklist

  • Provision PostgreSQL with pgvector and the required schema.
  • Use separate bootstrap, migration, and DML-only runtime database roles.
  • Set SYNAPSE_APPLY_DB_SCHEMA=false for the runtime role.
  • Provide stable SYNAPSE_ENCRYPTION_KEY and non-default SYNAPSE_API_KEY values through a secret manager.
  • Choose a real embedding provider and verify the configured model dimensions.
  • Enable TLS, restrict network access, and protect database volumes and backups.
  • Test backup restoration, key custody, retention, and deletion procedures.
  • Validate the exact workload and threat model before enabling guard enforcement.

Follow the full operations runbook, backup and recovery guide, and security policy. Helm deploys the engine and gateway; PostgreSQL is an external dependency.

06 / SECURITY MODEL

Know the data boundary

What is field-encrypted?

The authoritative memory content field is encrypted using Fernet (AES-128-CBC + HMAC-SHA256).

What remains readable?

The content_plain search projection, PostgreSQL text-search derivative, and vector embeddings remain readable by design to support retrieval.

What is tenant-isolated?

PostgreSQL RLS protects memory and trace data when the required forced RLS policies and least-privilege runtime role are correctly configured.

What is not claimed?

Synapse does not claim a compliance certification, universal encryption of all derivatives, or proven reliability on customer workloads.

Treat database dumps and backups as sensitive data artifacts. Enable operator-managed volume/database encryption, restrict restore access, and retain encryption keys separately but recoverably.
07 / COMMON QUESTIONS

Troubleshooting

Connection refused on port 8008

Confirm terminal 1 is still running, check the Uvicorn startup output, and verify the host and port used by the client.

HTTP 403 from the engine

Check the configured API key, X-Synapse-API-Key header, and tenant ID. The development-open path applies only to a fully unconfigured local setup; once authentication is configured, anonymous calls are rejected.

HTTP 429

The configured rate limit was reached. Back off and review RATE_LIMIT_PER_MIN and Redis configuration.

Readiness returns 503

Inspect engine logs and verify database connectivity, schema availability, and the runtime database role.

Retrieval returns an empty context

Confirm the memory write succeeded and inspect engine logs. The deterministic hash embedder is not semantic; use a real embedding provider to evaluate semantic retrieval.

Can I use 1.4.0 from PyPI?

Not yet. The published package is 1.3.1. Version 1.4.0 is present in the repository source but has not been published to PyPI.

08 / GO DEEPER

Reference documentation

STILL UNCLEAR?

Tell us where the docs fell short.

You can answer just one question. The feedback page prepares a draft for you; nothing is submitted automatically.

Share feedback →