v2.3.9b1

AtMem 2.3.9b1 — Optional local Laya memory formation

AtMem 2.3.9b1 adds an opt-in, locally runnable Laya System One profile for
bounded memory-formation decisions. It classifies the permitted operation,
memory class, evidence support, authorized target and retrieval usefulness;
AtMem still owns authority, state mutation, post-write validation, fallback,
review and deletion. Existing deterministic behavior remains the default.

The release also publishes a 12,000-scenario/60,000-decision synthetic dataset
and the fine-tuned model in the atmem Hugging Face organization:

• AtMem Laya Formation Dataset
• AtMem Laya Formation Model

Install or upgrade

Back up AtMem Home and stop long-running writers before upgrading. The normal
installation does not install Laya or download a model:

python -m pip install --upgrade --pre "atmem==2.3.9b1"
atmem --version
atmem init
atmem status

This installs exact companions atmem-atbot==0.1.1b1 and
atflows==0.1.4b3. Restart long-running agents and dashboards after upgrade.

For OpenClaw, let AtMem install the matching prerelease bridge
openclaw-memory-atmem@2.3.9-beta.1:

atmem openclaw upgrade
atmem control verify --probe

Do not install the npm bridge directly.

Opt in to local Laya formation

Install the optional runtime explicitly:

python -m pip install --upgrade --pre "atmem[laya-formation]==2.3.9b1"
atmem formation preview --download
atmem formation setup --download --device auto --yes
atmem formation doctor
atmem formation activate --yes
atmem formation status

preview changes nothing. setup anonymously downloads the exact public model
revision, verifies every artifact and calibration binding, and stages an
inactive profile. Only activate --yes changes the selected formation profile.
The model proposes finite choices; it cannot widen evidence, scope or mutation
authority. If the model rejects, times out, overflows or abstains, AtMem uses the
declared deterministic fallback/review path.

To return to the byte-identical staged state saved before activation:

atmem formation rollback --yes
atmem formation status

Bounded AtBot escalation is a separate opt-in. Add --escalation during
preview/setup, then configure an AtBot provider explicitly. Setup does not
enable remote egress: the profile starts with one-call/no-retry limits, zero
allowed remote cost and egress denied until the operator changes provider
policy.

User-visible benefit and measured evidence

On the frozen synthetic AtMem Formation benchmark, fine-tuned Laya produced the
exact canonical state for 80/80 scenario clusters, versus 34/80 for current
deterministic AtMem and 29/80 for unmodified Laya. It had zero safety violations
versus 19 and 3 respectively. Ten thousand paired cluster bootstrap resamples
put the exact-state improvement over deterministic AtMem at +0.575, with a 95%
interval of +0.468 to +0.684.

The strict store-then-retrieve workflow passed 80/80 clusters with fine-tuned
Laya versus 7/80 with deterministic AtMem. The improvement was in deciding what
state to store, not in ranking: both arms had retrieval MRR@5 0.3798 and
Recall@5/10 1.0 over 61 positive fixed-pool queries. On an Apple-silicon CPU,
fine-tuned formation took a median 272 ms per finite choice versus 2.3 ms for
the deterministic rules. The bounded-escalation arm made zero provider calls in
this run.

These are synthetic results, not production or general customer evidence. Jev
exposed no concrete immutable model identity, and the pinned Qwen deployment
failed before inference, so every formation, retrieval and combined comparison
against Jev or Qwen is inconclusive. No intended-scale candidate run exists for
both LoCoMo and LongMemEval/store-to-retrieval. See the
checksum-bound evaluation report.

Compatibility

The base wheel passed clean source-isolated installs on Python 3.10, 3.11, 3.12
and 3.13. The exact optional model and candidate wheel completed real bounded
inference on:

Host	CPU	Accelerator
macOS 26.5.2, Apple M2, Python 3.12.13	passed	MPS passed
Windows 11 build 26200, Python 3.12.6	passed	CUDA passed on Quadro P2000
Ubuntu 22.04, Python 3.11.13	passed	CUDA passed on RTX 2070 Super

Explicit CUDA on macOS and MPS on Windows/Linux fail before activation with an
actionable diagnostic. The full optional model was tested on Apple-silicon
macOS, not Intel macOS. A normal base install remains model-free and works
without PyTorch or Laya.

Migration, compatibility and limits

• Upgrading from published AtMem 2.3.8 requires no canonical-memory migration.
  A persisted 2.3.8 record remained recallable after candidate upgrade and
  exact rollback.
• Existing CLI, MCP, HTTP, AtBot protocol, OpenClaw and AtFlows contracts remain
  compatible; formation status is additive in CLI, MCP and dashboard surfaces.
• OpenClaw hook-context compatibility is fixture-reviewed through 2026.10.1;
  unlisted host versions still fail closed rather than being silently accepted.
• Laya 0.4.2, the model revision, questions, tokenizer and calibration are
  pinned and checksum-bound. The model export is about 800 MB; optional runtime
  dependencies require additional disk and memory.
• The shipped calibrated questions use three to five choices. Laya may warn
  about an unused 11+ choice calibration bucket during load; that bucket is not
  used by this profile, and AtMem installs and verifies its own bound 3–5-choice
  calibration before inference.
• Model decisions remain proposals. AtMem reloads and revalidates canonical
  state before disposition and never grants a model direct storage authority.
• Synthetic perfect accuracy can reflect the controlled generator and does not
  establish behavior on real customer language, all adversarial inputs or
  every memory domain.
• The release is a beta. The model profile is inactive by default, never
  downloads during ordinary upgrade, and is fully reversible.

v2.3.8

AtMem 2.3.8 — Governed context and one-command Hermes setup

AtMem 2.3.8 adds a source-linked context engine and a reversible Hermes
installation path while preserving AtMem's role as the memory and governance
authority. It forms typed evidence from immutable source episodes, retrieves
different evidence shapes for facts, transitions, procedures and action
constraints, expands bounded source neighbourhoods, and reports whether the
assembled context is sufficient, partial, conflicted or unsupported.

Install or upgrade

Back up AtMem Home and stop writers before upgrading. In the Python environment
used by the agent:

python -m pip install --upgrade "atmem==2.3.8"
atmem --version
atmem init
atmem status

AtMem installs the compatible companions atmem-atbot==0.1.0 and
atflows==0.1.4b3. AtFlows remains optional at runtime. Long-running dashboards
and agents must be restarted after upgrade.

For OpenClaw, use the Python-owned installer so the matching
openclaw-memory-atmem@2.3.8 bridge, saved configuration and verification steps
stay aligned:

atmem openclaw upgrade
atmem control verify --probe

Do not install the npm bridge directly.

Hermes setup

The safe default creates an isolated Hermes memory scope and starts in shadow
mode. It does not share OpenClaw or another agent's memory and does not inject
AtMem context into the model:

atmem install hermes --yes
atmem hermes status --json

To make sharing and active recall explicit:

atmem install hermes --memory shared --activate --verify-turn --yes
atmem hermes status --json

The installer discovers Hermes, records its previous provider, installs the
native AtMem provider, imports supported existing memory as reviewable proposals
rather than silently admitting it, and can verify one temporary recall lifecycle.
Restore is reversible and refuses to overwrite later user edits:

atmem restore hermes --yes

For bounded native Hermes model/tool observation, install or retain AtFlows
0.1.4b3 and use its guided Hermes connection. Memory works without AtFlows.

Context and retrieval changes

• Immutable source episodes now form typed facts, rules, procedures, state
  transitions, gotchas, premises and raw-state ranges with source links.
• Information-need routing uses exact, lexical, semantic, temporal and graph
  nominations without granting any candidate authority by similarity alone.
• Bounded evidence neighbourhoods keep the trigger, condition, action, outcome
  and adjacent identity details together.
• Context packing prioritizes complementary coverage and keeps addressed-action
  evidence contiguous, including exact dates, identifiers, recipients and
  source-backed email addresses.
• Sufficiency receipts distinguish complete evidence from missing obligations.
  The Dolphin adapter can block before model or tool invocation and names the
  missing requirement; AtMem itself remains a context provider rather than an
  action executor.
• Agent scopes remain isolated by default. Explicit shared-memory setup reuses
  a governed scope; it does not merge all agents' data into one unscoped table.

Bounded evaluation evidence

The release-candidate code was measured on frozen development samples with the
same reader and judge routes for each compared arm. These are not official or
statistically representative leaderboard scores.

Development surface	AtMem	Matched comparison
LongMemEval-V2, 23/451 questions	5/23	AgentRunbook-R 4/23; Mem0 1/23
DolphinBench, 30/600 tasks	9/30	Mem0 7/30
DolphinBench checks	32/97	Mem0 27/97
AGMI audit chain only	8/9	Whole-store rollback remains undetectable
AGMI with external checkpoint	9/9	All nine pinned attacks detected

All system failures remained in the denominators. The final Dolphin arms had
zero system failures. The Mem0 Dolphin environment lacked its optional spaCy
and fastembed extras. Read the exact hashes, controls and limitations in the
frozen 5% report.

Migration, compatibility and limits

• No canonical-memory database migration is required solely for this upgrade.
  Existing encrypted stores remain authoritative; V3 context views are derived
  and can be rebuilt from retained sources.
• Encrypted household activation still requires a working SQLCipher runtime.
  Stop all writers and retain a backup before any explicit encryption migration.
• Hermes setup was verified end to end on macOS with Hermes Agent 0.21.5. Linux
  uses the same local contract; Windows Hermes uses the documented WSL route.
  Native Windows credential-ACL parity is not claimed.
• The OpenClaw declaration matrix covers the minimum 2026.7.1-2, the pinned
  2026.8.1, and reviewed 2026.9.x fixtures through 2026.9.9. Unlisted host
  versions remain fail-closed until their hook surface is reviewed.
• Shadow mode withholds context by design. Active injection requires
  --activate; cross-agent sharing requires --memory shared.
• AtFlows 0.1.4b3 observes bounded native Hermes metadata, not every possible
  host event. Generic proxy/OTLP redaction remains an AtFlows release concern.
• Audit-chain-only storage cannot detect a valid whole-store snapshot rollback.
  The 9/9 AGMI result requires a trusted checkpoint outside the
  attacker-controlled store directory.
• The 5% evaluations do not justify a full-benchmark, leaderboard or universal
  superiority claim. Full held-out qualification remains future work.

The detailed architecture and evidence changes from 2.3.7 are recorded in the
2.3.7 to 2.3.8 technical report.

v2.3.8b6

AtMem 2.3.8b6 — One-command Hermes setup

AtMem 2.3.8b6 turns the Hermes preview into a reversible, one-command setup.
The installer discovers Hermes, creates a scoped AtMem connection, installs the
native provider, preserves the previous provider, inventories existing Hermes
memory as reviewable proposals, and can prove a real recall turn before it
reports success. It pairs with the published AtFlows 0.1.4b3 observer.

Install or upgrade

python -m pip install --pre --upgrade "atmem==2.3.8b6"
atmem init
atmem install hermes --yes

The safe default gives Hermes an isolated memory scope and shadow mode. Shadow
mode records governed capture and context-withholding evidence without injecting
AtMem context into the model.

Alternatively, make the first setup deliberately share the primary AtMem memory
with Hermes, activate recall and verify a real temporary memory end to end:

atmem install hermes --memory shared --activate --verify-turn --yes
atmem hermes status --json

The matching observability companion is:

python -m pip install --pre --upgrade "atflows==0.1.4b3"

atmem openclaw install installs the pinned
openclaw-memory-atmem@2.3.8-beta.6 bridge; do not install the bridge directly.

Restore and migration behavior

atmem restore hermes --yes

Restore disables the scoped binding and restores the provider recorded in the
setup receipt. The pre-switch Hermes configuration is retained in an encrypted,
hash-verified backup. Restore refuses to overwrite later user edits.

Existing MEMORY.md and USER.md content is never silently admitted into
governed memory. Supported content becomes quarantined proposals for review;
the original files remain unchanged. Re-running with the same memory scope is
idempotent. To change between isolated and shared memory, restore first and then
run setup with the new scope. Interrupted lifecycle evidence is retained in a
durable local spool and retried after a service restart.

Compatibility and honest limits

• Verified end to end on macOS with Hermes Agent 0.21.5. Linux and WSL use the
  same local file/provider contract but remain unqualified in this beta. Native
  Windows credential ACL support remains an explicit follow-up target.
• Isolated memory is the default. Shared memory requires --memory shared.
• Context injection requires --activate; shadow mode intentionally withholds it.
• --verify-turn uses and then deletes a random temporary fact. It proves the
  installed route and completed five-event lifecycle, not every future model answer.
• AtFlows is optional for memory. Install 0.1.4b3 to capture bounded native Hermes
  model/tool metadata in a distinct service bucket; cost is unknown when Hermes
  does not report usable token/model data.
• No database migration is required. Setup does not delete existing memories,
  proposals, evidence, or Hermes files.

v2.3.8b5

AtMem 2.3.8b5 — Hermes preview

AtMem 2.3.8b5 is the corrected beta release for the Hermes adapter. It pairs
with the published AtFlows 0.1.4b2 observer and also makes the upgrade smoke
gate derive its expected package versions from the release metadata, so future
beta and stable upgrades do not compare against a stale hard-coded version.

Install or upgrade

python -m pip install --pre --upgrade "atmem==2.3.8b5"
atmem init
atmem status
atmem hermes install
atmem hermes status --json

AtMem pins atflows==0.1.4b2; install it directly when needed:

python -m pip install --pre --upgrade "atflows==0.1.4b2"

The matching OpenClaw bridge is openclaw-memory-atmem@2.3.8-beta.5.

Compatibility and limits

This beta is opt-in and does not require a database migration. Hermes still
needs a reviewed, scoped runtime connection before it can become the active
memory provider; installing the adapter does not create credentials or change
provider selection. The local observer and AtFlows receiver remain loopback
by default and omit prompts, tool arguments, responses, authorization headers,
and keys from telemetry.

v2.3.7

AtMem 2.3.7 — Preserve work. Resume with evidence.

AtMem 2.3.7 brings product-owned continuity to supported LangGraph applications:
save what happened, reuse completed results after a restart, and stop uncertain
actions instead of blindly repeating them. AtFlows 0.1.3 makes those attempts
inspectable and adds grouped event charts.

What you get

Resume work from durable state

Registered tools can use AtMem's governed operation identities, attempt leases
and encrypted receipts. After a restart, the application can reuse a saved result
or query a destination that explicitly supports reconciliation. When the result
cannot safely be established, AtMem asks for confirmation rather than guessing.
Permissions, operator pause and key lock remain authoritative.

Open Decisions → Resume work to inspect saved workflows and next actions.
This is an explicit integration, not an automatic upgrade to every agent tool.
Start with the continuity guide and its installed document
example. Supported hosting is synchronous, file-backed LangGraph with registered
tools and declared destination capabilities.

See the attempts in AtFlows

AtFlows Activity → Resume work joins workflow, operation, run and attempt
identities with reported retry/recovery costs. Missing prices remain unknown.
AtFlows observes execution; only AtMem authorizes governed work.

The Timeline also adds Group by charts for tool, service, model, event type
and hour. Click a bar to see its events. Counts describe the latest 100 matching
events, not an all-history or workflow-success total. Typography now follows
AtMem across both themes.

Easier local setup and Windows reliability

This stable release includes the 2.3.7 beta onboarding and concurrency changes:
managed, checksum-verified Bun setup when needed; serialized encrypted-store
access; and bounded retries for transient Windows atomic replacement failures.
Home and control-state creation no longer call POSIX-only fchmod on Windows.
AtFlows sets its SQLite busy timeout before initializing continuity tables.

Evidence you can inspect

Test situation	Observed result
Document published, receipt saved, worker killed	Restart left one document; saved result reused
Document published, worker killed before receipt saved	Restart left one document after destination reconciliation
Public retail exchange accepted, response lost	AtMem-connected arms made no repeat exchange request; stopped for confirmation
Same retail fault without AtMem	One repeat request; the store rejected it, so no second store change

The document tests used an installed product and an external crash rig: recovery
was performed by product code, not benchmark repair code. Native Windows checks
also exercised both receipt failure windows and the actual dashboards.

Read the full continuity report and raw evidence
and Windows verification.
The report separately preserves public-workload replay, fresh conversations,
grading and estimated costs. These are bounded acceptance/development results;
repeated held-out evaluation remains open. They do not establish a general
task-success advantage, universal exactly-once execution or a new leaderboard rank.
The Memory Integrity Benchmark report retains
its original tested-version provenance; it is not relabelled as a 2.3.7 rerun.

Install or upgrade

Back up your AtMem Home and AtFlows database with writers stopped first.
In the Python environment used by your services:

python -m pip install --upgrade "atmem==2.3.7"
atmem --version
atmem init
atmem status

The coordinated packages are AtMem 2.3.7, AtBot 0.1.0, AtFlows 0.1.3
and openclaw-memory-atmem@2.3.7. Pip installs packages; atmem init performs
setup/startup and reports actual dashboard URLs. Restart existing long-running
services after upgrading. For OpenClaw:

atmem openclaw upgrade
atmem control verify --probe

For standalone AtFlows, use python -m pip install --upgrade "atflows==0.1.3"
and follow its setup guide.

Opt-in, migration and compatibility

The OpenClaw declaration matrix includes 2026.9.6's default-v1 tool context;
its optional owner/session fields remain fail-closed when absent. This is a
declaration-contract check, not proof of runtime identity population. The bridge
suite also passes against the locked 2026.8.1 SDK. Verification recognizes
OpenClaw's materialized safe requireDirectSupport: true default without treating
it as configuration drift; explicit unsafe or unrelated changes still fail.

Continuity is off until a workflow is explicitly configured and enabled. It
requires full capture. First continuity creation advances that evidence vault
to schema 3; older schema-2 readers refuse it. Preserve a pre-opt-in backup:
there is no in-place downgrade. Ordinary evidence-only use remains schema 2.

LangGraph owns its checkpoint; protect that separate database independently.
The qualified LangGraph versions are 1.1.5 and 1.2.12. A lost receipt may require
waiting for the 120-second attempt lease before another worker can proceed.
Non-queryable, non-idempotent destinations may require human confirmation.
This is a bounded local sequential profile, not a distributed workflow engine.

AtFlows observation requires an explicitly configured producer token and SDK;
it does not capture every model/tool call automatically. Observer outages do not
grant or revoke execution authority. OpenClaw and AtBot retain their existing
memory/evidence integrations; arbitrary tools are not automatically made restart-safe.

Windows SSH-session lifetime testing required a scheduled-task launcher to keep
dashboards alive after disconnect. That test workaround is documented, not an
automatic service-install capability claimed by this release.

v2.3.7b2

AtMem 2.3.7 beta 2 — concurrent Windows dashboard reliability

AtMem 2.3.7b2 is a focused prerelease correction for concurrent access to the
encrypted local control and identity stores, especially on Windows. It prevents
simultaneous dashboard and delegated AtFlows sign-in requests in one AtMem
process from racing encrypted-container replacement, and tolerates bounded
transient Windows file-sharing failures during atomic replacement. AtMem 2.3.6
remains the stable recommendation while this beta receives clean-install and
concurrent-use review.

Install or upgrade

In the intended Python environment:

python -m pip install --pre --upgrade atmem==2.3.7b2
atmem --version
atmem init
atmem status

pip install installs AtMem, atmem-atbot==0.1.0, and atflows==0.1.2; it
does not start a service or configure an application to send telemetry. The
matching OpenClaw bridge is openclaw-memory-atmem@2.3.7-beta.2. Existing
OpenClaw users should run:

atmem openclaw upgrade
atmem control verify --probe

What changed from 2.3.7b1

Serialized encrypted control-store access

Encrypted control stores use an in-memory SQLite image and atomically replace
their encrypted on-disk container after a transaction. Two threads in one
process could previously load the same prior image and race their replacements.
AtMem now serializes those store lifetimes within the process, preserving the
existing cross-process household lock while preventing stale-image replacement
and Windows sharing violations.

This path is exercised by dashboard, evidence, and delegated companion requests.
It improves AtFlows shared-login reliability because concurrent AtFlows and
browser requests authenticate against AtMem's encrypted local state. It does
not merge the AtMem and AtFlows databases or make telemetry canonical memory.

Atomic identity and control replacement on Windows

Encrypted account/session document reads and replacements now share a
process-local lock. Identity and encrypted control-container replacement retry
transient Windows PermissionError failures for up to two seconds before
failing explicitly. Writes remain temporary-file-plus-atomic-replace operations;
the retry does not fall back to an in-place plaintext write.

Carried forward from beta 1

The 2.3.7b1 Windows onboarding and durability corrections remain included:

• atmem init can provision the pinned, checksum-verified Bun 1.4.2 runtime
  privately when AtFlows needs Bun and no compatible system runtime exists.
• Windows Store Python user-script discovery finds the matching AtFlows launcher.
• Dashboard and companion process checks use portable Windows process APIs.
• File durability keeps POSIX directory fsync and handles unsupported Windows
  directory handles without weakening file flush or atomic replacement.

Migration and compatibility

• No database, Home, evidence, memory, identity, or account migration is needed.
• Existing encrypted and plaintext Home data remains compatible.
• AtBot remains atmem-atbot==0.1.0; AtFlows remains atflows==0.1.2.
• The OpenClaw bridge changes only its exact release alignment to
  2.3.7-beta.2; its host compatibility floor and behavior are unchanged.
• Python 3.10–3.13 remains supported. The Python 3.14 Windows smoke remains an
  early portability check, not an expanded support promise.
• Memory, retrieval, evidence, authorization, AtFlows review, and framework
  adapter semantics are otherwise unchanged from 2.3.7b1.

Honest beta limitations

• AtMem Home remains a local single-writer design across processes. This fix
  serializes store access between threads in one process; it does not introduce
  multi-primary replication or cloud-sync conflict resolution.
• The bounded Windows replacement retry handles transient sharing violations,
  not persistent permission, ownership, storage, or antivirus policy failures.
• AtFlows remains a separate service and data store. Applications must still
  opt in to its model proxy or OTLP endpoints to produce telemetry.
• Automatic Bun provisioning still requires HTTPS access on first use when no
  compatible runtime is already available.
• AtMem records supported agent boundaries but cannot prove external side
  effects without independent receipts.

Roll back

To return to the stable release:

python -m pip install --upgrade atmem==2.3.6
atmem openclaw upgrade
atmem status

Downgrading changes executable behavior but does not rewrite Home data, identity
documents, or the private Bun runtime. Stop active writers and keep a verified
Home snapshot before changing versions.

v2.3.7b1

AtMem 2.3.7 beta 1 — reliable Windows onboarding

AtMem 2.3.7b1 is a prerelease correction for native Windows and Windows Store
Python installations. It makes dashboard and companion discovery use the
active Python user installation, replaces POSIX-only process and durability
assumptions, and lets atmem init provision the Bun runtime required by the
separately packaged AtFlows dashboard. AtMem 2.3.6 remains the stable
recommendation while this beta receives clean-install review.

Install or upgrade

In the intended Python environment:

python -m pip install --pre --upgrade atmem==2.3.7b1
atmem --version
atmem init
atmem status

pip install installs AtMem, atmem-atbot==0.1.0, and atflows==0.1.2; it
does not execute a post-install downloader or start a service. If compatible
Bun 1.1 or newer is absent, the subsequent atmem init command clearly
announces and downloads the pinned official Bun 1.4.2 archive, verifies its
release-pinned SHA-256 before extraction, and stores the executable under
~/.atmem/runtime/bun/1.4.2. It does not require administrator rights or
modify global PATH. A compatible system Bun is reused instead.

The matching OpenClaw bridge is
openclaw-memory-atmem@2.3.7-beta.1. Existing OpenClaw users should run:

atmem openclaw upgrade
atmem control verify --probe

What changed from 2.3.6

Automatic, verified Bun provisioning at initialization

atmem init now provisions Bun only when AtFlows needs it and no compatible
runtime is available. AtMem pins the official release URL and SHA-256 for the
supported Windows, Linux, and macOS x64 and ARM64 archives, enforces a 200 MiB
download limit, extracts only the single Bun executable, verifies its reported
version, and records source metadata beside the private runtime. Download and
verification progress goes to stderr so atmem init --json keeps valid JSON on
stdout.

atmem status identifies the Bun version, path, and whether it is a system or
AtMem-managed runtime. The managed path is added only to the environment of the
AtFlows process started by AtMem. AtFlows remains a separate service and data
store; installing or initializing AtMem does not configure any application to
send telemetry.

Windows Store Python launch and process fixes

Windows Store Python commonly installs console scripts and packages in its
user scheme. AtMem now discovers the exact nt_user scripts directory for the
AtFlows launcher. The dashboard daemon no longer hides the user-site package
with isolated-mode startup; instead it removes PYTHONPATH and PYTHONHOME,
uses AtMem's private runtime directory as its working directory, and marks the
detached process non-interactive. This prevents a background AtBot setup prompt
while preserving the safe deterministic fallback. Its bounded readiness window
also accommodates the slower first import from a cold Windows wheel environment.

Process status uses the Windows process API instead of the unsupported
POSIX-style os.kill(pid, 0) probe. The shared implementation is used by the
dashboard, Home service, AtBot service, and delegated provider lifecycle.

Portable durability and private-file checks

Directory fsync operations now use a portable helper: POSIX retains directory
fsync, while Windows treats unsupported directory handles as a platform
limitation after file flush and atomic replacement complete. The encrypted
evidence-key path no longer rejects a regular Windows file merely because NTFS
ACLs are not represented as Unix 0600 bits; POSIX mode-bit enforcement is
unchanged. Other optional provider/configuration paths retain their existing
platform constraints in this beta. No cryptographic format or authorization
rule changes.

Migration and compatibility

• No database, Home, evidence, memory, or account migration is required.
• Existing Home data and companion configuration are preserved.
• Existing compatible system Bun installations remain preferred and are not
  modified.
• A previously provisioned AtMem-managed Bun runtime is reused after its
  recorded executable digest and version validate; normal package downgrade
  does not silently delete it.
• AtBot remains atmem-atbot==0.1.0; model-assisted intelligence remains opt-in
  and the safe deterministic fallback remains available.
• AtFlows remains atflows==0.1.2. Its first web-runtime preparation may still
  need network access for its locked JavaScript dependencies.
• Python 3.10–3.13 remains supported. The native Windows CI smoke on Python
  3.14 is an early portability check, not an expanded support promise.
• OpenClaw, framework, memory, retrieval, evidence, and authorization semantics
  are otherwise unchanged from 2.3.6.

Honest beta limitations

• Automatic Bun provisioning occurs during atmem init, not during pip's wheel
  installation. Python packaging intentionally has no reliable post-install
  hook for this external runtime.
• Provisioning requires HTTPS access to the pinned official GitHub release. A
  blocked or offline download leaves AtMem core memory usable but AtFlows
  stopped, with an actionable error.
• Automatic assets cover Windows, Linux, and macOS on x64 and ARM64. Other
  platforms must install compatible Bun independently.
• The managed Bun executable does not place bun on the user's global PATH;
  it is private to AtMem-managed AtFlows.
• Some optional delegated-provider setup and broader Unix-oriented tests still
  assume POSIX permission bits. This beta qualifies core onboarding, Home,
  dashboard, AtFlows, process, and durability paths on Windows; it does not
  claim every optional provider lifecycle is native-Windows complete.
• AtMem records and governs supported agent boundaries; it still cannot prove
  external side effects without independent receipts.

Roll back

To return to the stable release:

python -m pip install --upgrade atmem==2.3.6
atmem openclaw upgrade
atmem status

Downgrading changes executable behavior but does not rewrite Home data or
delete the private Bun runtime. It can be removed manually while AtFlows is
stopped if it is no longer wanted.

v2.3.6

AtMem 2.3.6 — memory-integrity controls and portable locking

AtMem 2.3.6 is the stable promotion of the clean-clone reproduced 2.3.6b1
candidate. It strengthens three canonical-memory boundaries identified by the
public Memory Integrity Benchmark and incorporates portable Windows-safe file
locking. The published stable wheel repeated the 700-trial campaign with 400
PASS, 300 honestly NOT_REPRESENTABLE, zero FAIL, and zero ERROR.

Install or upgrade

python -m pip install --upgrade atmem==2.3.6
atmem --version
atmem init
atmem status

The matching OpenClaw bridge is openclaw-memory-atmem@2.3.6. Existing
OpenClaw users should refresh and verify it:

atmem openclaw upgrade
atmem control verify --probe

AtBot remains atmem-atbot==0.1.0, AtFlows remains atflows==0.1.2, and
Python 3.10–3.13 remains supported.

When a healthy managed AtFlows instance is detected, its validated local link
now appears in AtMem's persistent top navigation instead of the footer. The
link remains hidden before sign-in and when no safe loopback endpoint is
available.

What changed from 2.3.5

Secret-bearing semantic proposals are refused

Memory.submit_proposal now screens fact text, fact keys, and entities before
creating a canonical semantic record. A rejected proposal creates no active or
quarantined memory record. Its admission and audit result remain inspectable,
while the rejected-proposal ledger retains structural identifiers and digests
rather than content-bearing fields.

This is a semantic-memory boundary. Full-fidelity source and protocol evidence
may still retain exactly what a host supplied under AtMem's governed evidence
policy; semantic refusal is not represented as deletion of source evidence.

Derived memories preserve direct-parent taint

Proposals that name related_record_ids now persist those parents and inherit
their taint. Any untrusted or tainted direct parent forces the derived record
into quarantine with DERIVED_FROM_TAINTED, even when the immediate source is
authenticated. Parents must match the exact subject, agent, and workspace.

This is explicit direct-parent propagation, not graph-wide inferred
information-flow analysis.

Procedures require issued review authority

Typed procedure approval now requires instance-bound authorization issued by
AtMem from configured reviewer policy. Principal, operation, subject, agent,
workspace, nonce, and active instance are checked when the decision settles.
Caller-created authorization objects, cross-instance reuse, replay, widened
scope, and plain actor labels fail closed.

The authenticated Administrator dashboard uses this boundary. Embedded users
configure review_authorities and call Memory.issue_review_authorization.
The generic CLI continues to review ordinary proposals but refuses procedure
decisions because it has no authenticated identity session.

Portable process-reentrant locking

Storage, control-state, and delegated-transport locks use one process-reentrant
implementation backed by flock on POSIX and msvcrt.locking on Windows.
Optional O_NOFOLLOW and O_NONBLOCK flags remain active where supported.
Native Windows CI exercises CLI import, nested locking, remember, and recall.

Memory Integrity Benchmark result

The stable 2.3.6 wheel was installed from its published SHA-256-pinned PyPI
artifact and run for 100 trials in each of seven categories:

Category	Result
Recursive agent hallucination	100/100 PASS
Summary trust laundering	100/100 PASS
Repetition to authority	100/100 PASS
Secret ingestion	100/100 PASS
Direct procedural poisoning	100 NOT_REPRESENTABLE
Outcome laundering	100 NOT_REPRESENTABLE
Authorized promotion	100 NOT_REPRESENTABLE

AtMem therefore passed 400/400 trials for controls the harness could represent,
with zero failed or errored trials. By simple native-category coverage this
would place AtMem second among the currently published systems, behind the
benchmark author's LLMBASEDOS result and ahead of Mem0 and Letta. This is not
an official leaderboard position until the upstream maintainers accept the
submission. The adapter and complete evidence package are now in
upstream PR #1.

AtMem is not first because Harness Specification v1 supplies caller-controlled
principal labels rather than an authenticated AtMem review authorization. It
would be unsafe and misleading for the adapter to turn those labels into
approval authority merely to gain three passes. The exact evidence, comparison,
and limitation are documented in the
Memory Integrity Benchmark report.

The stable run contains 700 trials: 400 PASS, 300 NOT_REPRESENTABLE, zero
FAIL, and zero ERROR. Publication validation and every evidence checksum
pass. Its run identity is atmem-v2.3.6-seed-20260922; prerelease evidence was
not relabelled as a stable run.

Migration and compatibility

• No database schema migration is required.
• Existing records, evidence, audit events, identities, and Home layout remain
  intact.
• Existing secret-bearing records created by earlier releases are not silently
  removed. Inspect and forget them through governed lifecycle operations.
• Non-procedure review integrations remain compatible. Procedure approvers must
  adopt issued review authorization.
• Retrieval, graph, AtBot, AtFlows, and egress defaults are unchanged.
• Source evidence can retain input that semantic memory refuses; evidence
  access, retention, export, and deletion remain separately governed.

Known limitations

• Purpose-scoped recall is not implemented or claimed by this release.
• Taint propagation follows explicit direct parents; it does not infer hidden
  semantic dependencies or arbitrary graph-wide flows.
• Reviewer configuration is local application policy, not a federated identity
  protocol.
• The benchmark measures seven narrow memory-integrity controls, not retrieval
  quality, latency, complete product security, compliance, or certification.

To return to 2.3.5:

python -m pip install --upgrade atmem==2.3.5
atmem openclaw upgrade

Downgrading changes executable behavior; it does not rewrite records created
while 2.3.6 was installed.

v2.3.6b1

AtMem 2.3.6 beta 1 — memory-integrity qualification

AtMem 2.3.6b1 is a prerelease security and portability correction driven by the public
Memory Integrity Benchmark.
It preserves the complete AtMem 2.3.5 baseline run and changes three narrowly
defined canonical-memory boundaries that the baseline exposed. This beta is for
independent rerunning and review before any stable 2.3.6 release is considered.

Install or upgrade

python -m pip install --pre --upgrade atmem==2.3.6b1
atmem --version
atmem init
atmem status

The matching OpenClaw bridge is
openclaw-memory-atmem@2.3.6-beta.1. Existing OpenClaw users should refresh the
bridge after upgrading:

atmem openclaw upgrade
atmem verify --probe

AtBot remains atmem-atbot==0.1.0 and AtFlows remains atflows==0.1.2.
Python 3.10–3.13 remains supported.

What changed from 2.3.5

Windows CLI and file locking

AtMem no longer imports POSIX-only fcntl while loading the CLI. Storage,
control-state, and delegated-transport locks now use one process-reentrant
portable implementation backed by flock on POSIX and msvcrt.locking on
Windows. Optional O_NOFOLLOW and O_NONBLOCK flags are retained where the
platform provides them. A native Windows/CPython 3.14 CI smoke exercises CLI
import, nested locks, remember, and recall; Python 3.14 remains an early CI
portability check rather than an advertised support-line expansion in this beta.

Secret-bearing semantic proposals are rejected

Memory.submit_proposal now applies AtMem's deterministic secret and explicit
exclusion screen before it creates a canonical semantic record. A rejected
proposal returns no active or quarantined record identifier and records the
reason in the admission/audit result.

This does not erase the original captured source/protocol evidence.
Full-fidelity evidence and semantic memory have different jobs: authorized
evidence may retain exactly what a host supplied, while the content is refused
from canonical memory records used by retrieval. The rejected proposal ledger
stores structural identifiers and digests, not its content-bearing fact,
fact-key, or entities. Existing secret-bearing records created by an older
release are not silently rewritten or deleted during upgrade.

Derived memories preserve parent taint

When a v1 proposal names related_record_ids, AtMem now persists those parent
identifiers and inherited taint labels on the new record. A derived record with
an untrusted or already-tainted parent is quarantined even when its immediate
source is authenticated. Related records must match the exact subject, agent,
and workspace authority scope.

This is direct-parent propagation for the v1 proposal path. It is not a claim
of arbitrary graph-wide information-flow analysis or semantic truth.

Procedures require issued review authority

Typed procedure proposals still enter the existing review queue. They can no
longer be approved using an arbitrary audit actor string. Approval requires an
instance-bound authorization issued by AtMem from a preconfigured principal,
permission scope, subject, agent, and workspace. The local dashboard maps an
authenticated Administrator session into this native review boundary. Ordinary
non-procedural review remains backward compatible.

The authorization token is intentionally bound to the active Memory instance
and cannot be reused after it closes. Direct embedded users that review
procedures must configure review_authorities and call
Memory.issue_review_authorization; supplying a caller-created
ReviewAuthorization is rejected.

The generic atmem proposals decide CLI continues to review non-procedural
proposals only; it has no authenticated identity session and therefore refuses
procedure decisions with guidance instead of treating --actor as authority.
Use the authenticated Administrator dashboard or the embedded issued-authority
API for procedures.

Benchmark purpose and evidence

The frozen 2.3.5 run contains 700 trials (100 in each of A, C, D, F, H, I, and
L), including every failure and NOT_REPRESENTABLE result. Its raw JSONL,
manifest, environment, limitations, and checksums remain published on the
benchmark branch. The 2.3.6b1 run uses the same attack definitions, seed,
denominators, and publication checks and receives a separate immutable run
identity.

The benchmark tests specific memory-integrity controls. It does not establish
general retrieval accuracy, latency leadership, complete product security, or
regulatory compliance. A detailed comparison is published in
docs/benchmarks/memory-integrity.md after
the actual 2.3.6b1 artifact completes the full rerun.

Migration and compatibility

• No database schema migration is required.
• Existing records, evidence, audit events, identities, and Home layout are
  preserved.
• Existing 2.3.5 secret-bearing quarantined records are not retroactively
  removed. Inspect and forget them through the normal governed lifecycle where
  appropriate.
• Existing non-procedure review integrations continue to work with an audited
  actor value. Procedure approval integrations must adopt issued authority.
• Retrieval strategy defaults, graph recall defaults, AtBot behavior, AtFlows
  behavior, and external-provider egress defaults are unchanged.
• A source episode or encrypted Agent Black Box record may still retain input
  that semantic memory rejects; access and deletion follow the evidence policy.

Honest beta limitations

• Purpose-scoped recall remains unimplemented and is not declared to the
  benchmark.
• Parent taint propagation covers explicitly related records; it does not infer
  undisclosed dependencies.
• Configured procedure reviewers are local application policy, not a remote
  identity federation protocol.
• The prerelease is not a stable recommendation until its tagged workflows,
  installed artifacts, and complete 700-trial rerun are verified.

To return to the previous stable release:

python -m pip install --upgrade atmem==2.3.5
atmem openclaw upgrade

Downgrading restores the older executable behavior; it does not rewrite records
created while 2.3.6b1 was installed.

v2.3.5

AtMem 2.3.5

Stable release. AtMem 2.3.5 simplifies local onboarding and makes the AtMem and AtFlows dashboards easier to navigate together. atmem init now starts the AtMem dashboard, the pinned AtFlows companion in AtMem-delegated login mode, and AtBot where available. atmem status reports installed and running versions, actual local URLs and ports, and actionable startup errors. If the preferred dashboard port is occupied, initialization chooses and reports an available loopback port. The AtMem dashboard links to the detected AtFlows dashboard; AtFlows 0.1.2 links back when delegated login is configured. Browser titles and favicons use the AtMem.ai product identity. AtFlows server logs now display local time with an explicit offset.

Install and upgrade

Back up or snapshot a quiescent AtMem Home before upgrading. In the Python environment used by AtMem:

python -m pip install --upgrade atmem==2.3.5
atmem init
atmem status

For an existing OpenClaw connection, also run:

atmem openclaw upgrade
atmem control verify

For a new OpenClaw connection, use atmem openclaw install after initialization. AtMem 2.3.5 pairs with openclaw-memory-atmem@2.3.5, pins atflows==0.1.2 and keeps atmem-atbot==0.1.0. Python 3.10–3.13 is supported. Running AtFlows needs Bun 1.1 or newer and may need network access on its first launch to prepare its bundled runtime. Installing the wheel alone does not start services or collect telemetry.

atmem init is safe to repeat: it preserves existing AtMem Home, memory, evidence, AtFlows data, and account credentials. It does not reissue an existing Administrator password. On upgrade, it restarts a stale AtMem dashboard and checks each companion. If AtFlows or AtBot cannot start, it reports the error; AtMem's core memory remains available. Run atmem status to see the current state and URLs rather than assuming the default ports. A pre-existing independently started AtFlows instance is reported, not silently taken over. Review any existing standalone AtFlows account and authentication setup before switching to the AtMem-managed instance.

What changed from 2.3.4

• One initialization command starts and checks the local dashboards and AtBot companion. Status shows version and port mismatches with a repair path.
• The AtMem dashboard exposes a link to a healthy local AtFlows dashboard; the delegated AtFlows dashboard links back to AtMem. Both show consistent browser identity.
• AtFlows 0.1.2 logs server timestamps in local time with an explicit offset.

Boundaries and limitations

AtFlows remains a separate local observability service and database. Starting it does not configure a client to send telemetry, authenticate its OTLP receiver or model proxy, convert traces into canonical memory, or enable the read-only review-lead handoff. The latter remains an explicit investigation using atmem atflows review and exact session evidence. AtMem does not alter OpenClaw or another host unless you run that adapter's installation or upgrade command. Memory injection remains governed by the existing shadow/active state; initialization does not activate it. Keep local listeners on trusted loopback interfaces and review any reported startup error before relying on the companion dashboards.