Version: 1.0.6
Last Updated: April 2026
Classification: Public
Standard: Banking-Grade Infrastructure (Padrão Bancário BR)

Synapse Layer v1.0.6 implements a Cognitive Security Protocol — four independent, non-bypassable security layers that protect every memory operation from ingestion to cross-agent transfer.

Architecture: Zero-Knowledge. You own encryption keys. The server never sees plaintext.

Compliance: GDPR, LGPD, HIPAA ready.

Every store() call passes through this pipeline. No exceptions. No bypasses.

Agent Input
  │
  ├── Seal 1: Semantic Privacy Guard™
  │     ├─ 12 regex patterns detect PII (email, SSN, CPF, credit cards, etc.)
  │     ├─ SHA-256 hash of each redacted item (forensic audit)
  │     ├─ Aggressive mode: proper noun stripping
  │     └─ Risk score + sensitivity classification
  │
  ├── Seal 2: Differential Privacy
  │     ├─ Gaussian noise injection on embedding vector
  │     ├─ σ = Δf · √(2·ln(1.25/δ)) / ε
  │     ├─ L2 normalization preserves cosine similarity
  │     └─ SNR metric in audit payload
  │
  ├── Seal 3: Intelligent Intent Validation™
  │     ├─ Step 1: Agent suggests intent (keyword heuristic)
  │     ├─ Step 2: Synapse validates (confidence gate ≥ 0.85)
  │     ├─ 19 critical keywords → auto-promote to CRITICAL
  │     └─ Self-healing on recall: keyword consensus reclassification
  │
  ├── Encryption: AES-256-GCM (client-side)
  │     ├─ 256-bit key, 96-bit IV, 128-bit auth tag
  │     └─ PBKDF2-SHA256 key derivation (210k iterations)
  │
  └── Vault Persistence
        ├─ Encrypted blob + noise-injected embedding
        └─ Immutable audit trail with all flags

Module: synapse_memory/sanitizer.py
Status: Mandatory — cannot be bypassed in the standard pipeline

When aggressive_sanitize=True, proper nouns (capitalized words not at sentence start) are stripped. This prevents name-based correlation attacks across memory pools.

memory = SynapseMemory(agent_id="secure", aggressive_sanitize=True)
# "John Smith prefers dark mode" → "[REDACTED_NAME] prefers dark mode"

Every redacted item produces a SHA-256 hash stored in the audit payload. This enables:

• Non-repudiation: Prove a specific item was redacted without revealing it
• Compliance reporting: Count and classify PII encounters
• Forensic investigation: Match hashes against known PII if legally required

Module: synapse_memory/privacy.py
Status: Enabled by default (ε = 0.5)

Calibrated Gaussian noise is injected into embedding vectors before they are stored in pgvector. This prevents semantic inference attacks — even with full database access, the original semantic fingerprint cannot be reconstructed.

σ = Δf · √(2 · ln(1.25 / δ)) / ε

where:
  Δf = L2 sensitivity of the embedding function
  ε  = privacy budget (default 0.5)
  δ  = failure probability (default 1e-5)

After noise injection, vectors are L2-normalized to unit length. This preserves cosine similarity semantics for recall operations while maintaining the privacy guarantee.

Every store() includes:

{
  "privacy_applied": true,
  "epsilon": 0.5,
  "noise_sigma": 0.0234,
  "snr_db": 18.7
}

Module: synapse_memory/engine/validator.py
Status: Mandatory on every store() call

1. Agent Suggestion: Keyword heuristic scoring across all categories (saturation normalization with SATURATION_HITS=3)
2. Synapse Validation: Confidence gate, critical override, source assignment

emergency, breach, attack, ransomware, warrant, subpoena, exploit, vulnerability, incident, threat, unauthorized, compromise, malware, phishing, fraud, violation, compliance, audit, lawsuit

Any of these triggers automatic promotion to CRITICAL with confidence_boost = 1.0, regardless of agent-reported confidence.

During recall(), semantically proximate memories (cosine ≥ 0.85) with conflicting categories are detected. The weaker classification is corrected via keyword consensus.

Full SelfHealingResult audit payload:

@dataclass(frozen=True)
class SelfHealingResult:
    reclassified: bool
    original_category: IntentCategory
    new_category: IntentCategory
    reason: str
    evidence_scores: dict[str, float]

This prevents category drift attacks where adversaries store conflicting metadata to downgrade memory criticality over time.

Module: synapse_memory/engine/handover.py
Status: Production

Memories are persisted to the Status Ledger before any network transmission. If the target agent crashes, disconnects, or times out — nothing is lost.

PENDING → ACCEPTED → COMPLETED    (normal flow)
PENDING → FAILED                   (Emergency Checkpoint created)
PENDING → EXPIRED                  (grace period: summary returned)

Transition rules are strict and immutable. A COMPLETED handover cannot be reverted. A FAILED handover always creates an Emergency Checkpoint.

{
  "origin_agent": "gpt-4",
  "target_agent": "claude-3.5",
  "user_id": "user-123",
  "scope": "full",
  "memory_count": 42,
  "iat": 1712361600,
  "exp": 1712365200
}

Signature: HMAC-SHA256 with per-instance secret key.

When TTL expires but the handover is within the 15-minute grace window:

• Raw memory data is not returned
• A compact summary is auto-generated
• Summary is sufficient for the target agent to understand context
• Original data remains encrypted in the vault

On fail_handover():

• Full context snapshot is frozen
• Checkpoint is vault-persisted with failure reason
• Recovery can be manual or automated
• Checkpoint preserves all metadata including intent classifications

user_password + random_salt → PBKDF2(210k iterations) → 256-bit key

CREATE TABLE memories (
    id UUID PRIMARY KEY,
    agent_id UUID NOT NULL,
    encrypted_blob BYTEA NOT NULL,       -- AES-256-GCM ciphertext
    embedding vector(1536) NOT NULL,     -- Noise-injected semantic vector
    intent_category VARCHAR(50) NOT NULL,
    is_critical BOOLEAN DEFAULT FALSE,
    created_at TIMESTAMP NOT NULL,
    updated_at TIMESTAMP NOT NULL
);

-- Row-Level Security
ALTER TABLE memories ENABLE ROW LEVEL SECURITY;
CREATE POLICY agent_isolation ON memories
    FOR SELECT USING (agent_id = current_user_id());

Key points:

• encrypted_blob = AES-256-GCM ciphertext (server cannot decrypt)
• embedding = noise-injected vector (original semantics unrecoverable)
• intent_category = validated classification (not raw agent input)
• Row-Level Security isolates agents from each other

If you discover a security vulnerability:

1. Do NOT file a public GitHub issue
2. Email: security@synapselayer.org
3. Include: Description, reproduction steps, potential impact
4. Timeline: 48h response, 7-day patch target, public disclosure after fix

Email: security@synapselayer.org
Founder: founder.synapselayer@proton.me
Subscribe: https://synapselayer.org/security

Synapse Layer — Cognitive Security Protocol for AI Agents
v1.0.6 — April 2026