v2.3.6b1

AtMem 2.3.6 beta 1 — memory-integrity qualification

AtMem 2.3.6b1 is a prerelease security and portability correction driven by the public
Memory Integrity Benchmark.
It preserves the complete AtMem 2.3.5 baseline run and changes three narrowly
defined canonical-memory boundaries that the baseline exposed. This beta is for
independent rerunning and review before any stable 2.3.6 release is considered.

Install or upgrade

python -m pip install --pre --upgrade atmem==2.3.6b1
atmem --version
atmem init
atmem status

The matching OpenClaw bridge is
openclaw-memory-atmem@2.3.6-beta.1. Existing OpenClaw users should refresh the
bridge after upgrading:

atmem openclaw upgrade
atmem verify --probe

AtBot remains atmem-atbot==0.1.0 and AtFlows remains atflows==0.1.2.
Python 3.10–3.13 remains supported.

What changed from 2.3.5

Windows CLI and file locking

AtMem no longer imports POSIX-only fcntl while loading the CLI. Storage,
control-state, and delegated-transport locks now use one process-reentrant
portable implementation backed by flock on POSIX and msvcrt.locking on
Windows. Optional O_NOFOLLOW and O_NONBLOCK flags are retained where the
platform provides them. A native Windows/CPython 3.14 CI smoke exercises CLI
import, nested locks, remember, and recall; Python 3.14 remains an early CI
portability check rather than an advertised support-line expansion in this beta.

Secret-bearing semantic proposals are rejected

Memory.submit_proposal now applies AtMem's deterministic secret and explicit
exclusion screen before it creates a canonical semantic record. A rejected
proposal returns no active or quarantined record identifier and records the
reason in the admission/audit result.

This does not erase the original captured source/protocol evidence.
Full-fidelity evidence and semantic memory have different jobs: authorized
evidence may retain exactly what a host supplied, while the content is refused
from canonical memory records used by retrieval. The rejected proposal ledger
stores structural identifiers and digests, not its content-bearing fact,
fact-key, or entities. Existing secret-bearing records created by an older
release are not silently rewritten or deleted during upgrade.

Derived memories preserve parent taint

When a v1 proposal names related_record_ids, AtMem now persists those parent
identifiers and inherited taint labels on the new record. A derived record with
an untrusted or already-tainted parent is quarantined even when its immediate
source is authenticated. Related records must match the exact subject, agent,
and workspace authority scope.

This is direct-parent propagation for the v1 proposal path. It is not a claim
of arbitrary graph-wide information-flow analysis or semantic truth.

Procedures require issued review authority

Typed procedure proposals still enter the existing review queue. They can no
longer be approved using an arbitrary audit actor string. Approval requires an
instance-bound authorization issued by AtMem from a preconfigured principal,
permission scope, subject, agent, and workspace. The local dashboard maps an
authenticated Administrator session into this native review boundary. Ordinary
non-procedural review remains backward compatible.

The authorization token is intentionally bound to the active Memory instance
and cannot be reused after it closes. Direct embedded users that review
procedures must configure review_authorities and call
Memory.issue_review_authorization; supplying a caller-created
ReviewAuthorization is rejected.

The generic atmem proposals decide CLI continues to review non-procedural
proposals only; it has no authenticated identity session and therefore refuses
procedure decisions with guidance instead of treating --actor as authority.
Use the authenticated Administrator dashboard or the embedded issued-authority
API for procedures.

Benchmark purpose and evidence

The frozen 2.3.5 run contains 700 trials (100 in each of A, C, D, F, H, I, and
L), including every failure and NOT_REPRESENTABLE result. Its raw JSONL,
manifest, environment, limitations, and checksums remain published on the
benchmark branch. The 2.3.6b1 run uses the same attack definitions, seed,
denominators, and publication checks and receives a separate immutable run
identity.

The benchmark tests specific memory-integrity controls. It does not establish
general retrieval accuracy, latency leadership, complete product security, or
regulatory compliance. A detailed comparison is published in
docs/benchmarks/memory-integrity.md after
the actual 2.3.6b1 artifact completes the full rerun.

Migration and compatibility

• No database schema migration is required.
• Existing records, evidence, audit events, identities, and Home layout are
  preserved.
• Existing 2.3.5 secret-bearing quarantined records are not retroactively
  removed. Inspect and forget them through the normal governed lifecycle where
  appropriate.
• Existing non-procedure review integrations continue to work with an audited
  actor value. Procedure approval integrations must adopt issued authority.
• Retrieval strategy defaults, graph recall defaults, AtBot behavior, AtFlows
  behavior, and external-provider egress defaults are unchanged.
• A source episode or encrypted Agent Black Box record may still retain input
  that semantic memory rejects; access and deletion follow the evidence policy.

Honest beta limitations

• Purpose-scoped recall remains unimplemented and is not declared to the
  benchmark.
• Parent taint propagation covers explicitly related records; it does not infer
  undisclosed dependencies.
• Configured procedure reviewers are local application policy, not a remote
  identity federation protocol.
• The prerelease is not a stable recommendation until its tagged workflows,
  installed artifacts, and complete 700-trial rerun are verified.

To return to the previous stable release:

python -m pip install --upgrade atmem==2.3.5
atmem openclaw upgrade

Downgrading restores the older executable behavior; it does not rewrite records
created while 2.3.6b1 was installed.