Horizons v0.1.2: Production Ready

TL;DR

• Auth modes with secure-by-default production settings
• Webhook signing for payload verification
• Project slugs for friendly API references
• Stable SQL contracts for context entities (horizons_v1_context_entities)
• Config as code (TOML export/import/validate)
• SDLC primitives coming soon (typecheck, test, deploy with approval gates)
• GEPA compatibility — synth_ai.gepa drop-in for gepa-ai workflows

Horizons v0.1.2

Production-ready features for self-hosted and managed deployments.

Auth Modes

Simple auth configuration with secure defaults:

HORIZONS_AUTH_MODE=dev_insecure    # local dev
HORIZONS_AUTH_MODE=dev_strict      # external webhooks
HORIZONS_AUTH_MODE=production      # all safety rails (required for prod)

Production mode enforces:

• API key or OIDC JWT authentication
• Webhook signature verification
• MCP scope validation
• No insecure mutating headers

Webhook Signing

All outbound webhooks include x-horizons-signature headers with HMAC-SHA256 payload signatures:

# Verify webhook
signature = request.headers.get("x-horizons-signature")
expected = f"sha256={hmac_sha256(secret, body)}"
assert signature == expected

Project Slugs

Reference projects by name instead of UUID:

# Create with slug
project = await client.projects.create(name="my-app", slug="my-app")
 
# Use slug in API calls
events = await client.events.list(project="my-app")
actions = await client.actions.pending(project="my-app")
await client.tick(project="my-app", advance_seconds=3600)

Stable Context Entity Contract

Query context entities via horizons_v1_context_entities view instead of base tables:

-- Stable contract - won't break on internal schema changes
SELECT entity_id, entity_type, source_id, data, last_synced_at
FROM horizons_v1_context_entities
WHERE org_id = $1 AND source = $2 AND entity_type = $3;

Includes query-pattern indexes for common lookups (org/source/entity_type/source_id).

Config as Code

Export, validate, and apply configuration as TOML:

# Export current config
curl -X GET https://api.usesynth.ai/api/v1/config/export > config.toml
 
# Validate before applying
curl -X POST https://api.usesynth.ai/api/v1/config/validate \
  -H "Content-Type: text/toml" --data-binary @config.toml
 
# Apply with diff preview
curl -X POST "https://api.usesynth.ai/api/v1/config/apply?dry_run=true" \
  -H "Content-Type: text/toml" --data-binary @config.toml
 
# Apply idempotently
curl -X POST https://api.usesynth.ai/api/v1/config/apply \
  -H "Content-Type: text/toml" --data-binary @config.toml

All config mutations logged for audit.

GEPA Compatibility

Drop-in usage for gepa-ai style workflows:

from synth_ai import gepa
 
trainset, valset, _ = gepa.examples.aime.init_dataset()
result = gepa.optimize(
    seed_candidate={"system_prompt": "You are a helpful assistant."},
    trainset=trainset,
    valset=valset,
    task_lm="openai/gpt-4.1-mini",
    max_metric_calls=150,
    reflection_lm="openai/gpt-5",
)
print(result.best_candidate["system_prompt"])

Requires SYNTH_API_KEY. Full Banking77 runthrough: Benchmarking/demos/gepa_banking77_compat.py.

Coming Soon: SDLC Primitives

Onboard-managed Git workflows for agent-driven development:

• Repo workspaces: Clone, branch, edit, commit, push
• Check runs: typecheck, test, lint, build with deterministic bundles
• Deploy actions: Approval-gated redeploys with rollback
• Python sidecars: Deploy backend integrations with same SDLC lifecycle

Agents will be able to:

1. Edit code in onboard repo
2. Run checks (same commands as CI)
3. Propose deploy (approval required for production)
4. Monitor rollout and trigger rollback if needed

All check/deploy runs persist logs and artifacts.

OpenAPI Contract Enforcement

OpenAPI spec now CI-enforced:

• Generated from utoipa annotations
• Required check: ci/openapi-drift fails on uncommitted spec changes
• Enables versioned TypeScript/Python SDK generation
• Breaking changes require explicit version bump and migration notes

Documentation Refresh

10-minute quickstart launching soon:

• Install → create project → run agent → approve action → inspect events
• SDK reference with CI-enforced completeness
• OpenRevenue case study
• Production deployment checklists