v2.3.6

AtMem 2.3.6 — memory-integrity controls and portable locking

AtMem 2.3.6 is the stable promotion of the clean-clone reproduced 2.3.6b1
candidate. It strengthens three canonical-memory boundaries identified by the
public Memory Integrity Benchmark and incorporates portable Windows-safe file
locking. The published stable wheel repeated the 700-trial campaign with 400
PASS, 300 honestly NOT_REPRESENTABLE, zero FAIL, and zero ERROR.

Install or upgrade

python -m pip install --upgrade atmem==2.3.6
atmem --version
atmem init
atmem status

The matching OpenClaw bridge is openclaw-memory-atmem@2.3.6. Existing
OpenClaw users should refresh and verify it:

atmem openclaw upgrade
atmem control verify --probe

AtBot remains atmem-atbot==0.1.0, AtFlows remains atflows==0.1.2, and
Python 3.10–3.13 remains supported.

When a healthy managed AtFlows instance is detected, its validated local link
now appears in AtMem's persistent top navigation instead of the footer. The
link remains hidden before sign-in and when no safe loopback endpoint is
available.

What changed from 2.3.5

Secret-bearing semantic proposals are refused

Memory.submit_proposal now screens fact text, fact keys, and entities before
creating a canonical semantic record. A rejected proposal creates no active or
quarantined memory record. Its admission and audit result remain inspectable,
while the rejected-proposal ledger retains structural identifiers and digests
rather than content-bearing fields.

This is a semantic-memory boundary. Full-fidelity source and protocol evidence
may still retain exactly what a host supplied under AtMem's governed evidence
policy; semantic refusal is not represented as deletion of source evidence.

Derived memories preserve direct-parent taint

Proposals that name related_record_ids now persist those parents and inherit
their taint. Any untrusted or tainted direct parent forces the derived record
into quarantine with DERIVED_FROM_TAINTED, even when the immediate source is
authenticated. Parents must match the exact subject, agent, and workspace.

This is explicit direct-parent propagation, not graph-wide inferred
information-flow analysis.

Procedures require issued review authority

Typed procedure approval now requires instance-bound authorization issued by
AtMem from configured reviewer policy. Principal, operation, subject, agent,
workspace, nonce, and active instance are checked when the decision settles.
Caller-created authorization objects, cross-instance reuse, replay, widened
scope, and plain actor labels fail closed.

The authenticated Administrator dashboard uses this boundary. Embedded users
configure review_authorities and call Memory.issue_review_authorization.
The generic CLI continues to review ordinary proposals but refuses procedure
decisions because it has no authenticated identity session.

Portable process-reentrant locking

Storage, control-state, and delegated-transport locks use one process-reentrant
implementation backed by flock on POSIX and msvcrt.locking on Windows.
Optional O_NOFOLLOW and O_NONBLOCK flags remain active where supported.
Native Windows CI exercises CLI import, nested locking, remember, and recall.

Memory Integrity Benchmark result

The stable 2.3.6 wheel was installed from its published SHA-256-pinned PyPI
artifact and run for 100 trials in each of seven categories:

Category	Result
Recursive agent hallucination	100/100 PASS
Summary trust laundering	100/100 PASS
Repetition to authority	100/100 PASS
Secret ingestion	100/100 PASS
Direct procedural poisoning	100 NOT_REPRESENTABLE
Outcome laundering	100 NOT_REPRESENTABLE
Authorized promotion	100 NOT_REPRESENTABLE

AtMem therefore passed 400/400 trials for controls the harness could represent,
with zero failed or errored trials. By simple native-category coverage this
would place AtMem second among the currently published systems, behind the
benchmark author's LLMBASEDOS result and ahead of Mem0 and Letta. This is not
an official leaderboard position until the upstream maintainers accept the
submission. The adapter and complete evidence package are now in
upstream PR #1.

AtMem is not first because Harness Specification v1 supplies caller-controlled
principal labels rather than an authenticated AtMem review authorization. It
would be unsafe and misleading for the adapter to turn those labels into
approval authority merely to gain three passes. The exact evidence, comparison,
and limitation are documented in the
Memory Integrity Benchmark report.

The stable run contains 700 trials: 400 PASS, 300 NOT_REPRESENTABLE, zero
FAIL, and zero ERROR. Publication validation and every evidence checksum
pass. Its run identity is atmem-v2.3.6-seed-20260922; prerelease evidence was
not relabelled as a stable run.

Migration and compatibility

• No database schema migration is required.
• Existing records, evidence, audit events, identities, and Home layout remain
  intact.
• Existing secret-bearing records created by earlier releases are not silently
  removed. Inspect and forget them through governed lifecycle operations.
• Non-procedure review integrations remain compatible. Procedure approvers must
  adopt issued review authorization.
• Retrieval, graph, AtBot, AtFlows, and egress defaults are unchanged.
• Source evidence can retain input that semantic memory refuses; evidence
  access, retention, export, and deletion remain separately governed.

Known limitations

• Purpose-scoped recall is not implemented or claimed by this release.
• Taint propagation follows explicit direct parents; it does not infer hidden
  semantic dependencies or arbitrary graph-wide flows.
• Reviewer configuration is local application policy, not a federated identity
  protocol.
• The benchmark measures seven narrow memory-integrity controls, not retrieval
  quality, latency, complete product security, compliance, or certification.

To return to 2.3.5:

python -m pip install --upgrade atmem==2.3.5
atmem openclaw upgrade

Downgrading changes executable behavior; it does not rewrite records created
while 2.3.6 was installed.