v2.3.8b6

AtMem 2.3.8b6 — One-command Hermes setup

AtMem 2.3.8b6 turns the Hermes preview into a reversible, one-command setup.
The installer discovers Hermes, creates a scoped AtMem connection, installs the
native provider, preserves the previous provider, inventories existing Hermes
memory as reviewable proposals, and can prove a real recall turn before it
reports success. It pairs with the published AtFlows 0.1.4b3 observer.

Install or upgrade

python -m pip install --pre --upgrade "atmem==2.3.8b6"
atmem init
atmem install hermes --yes

The safe default gives Hermes an isolated memory scope and shadow mode. Shadow
mode records governed capture and context-withholding evidence without injecting
AtMem context into the model.

Alternatively, make the first setup deliberately share the primary AtMem memory
with Hermes, activate recall and verify a real temporary memory end to end:

atmem install hermes --memory shared --activate --verify-turn --yes
atmem hermes status --json

The matching observability companion is:

python -m pip install --pre --upgrade "atflows==0.1.4b3"

atmem openclaw install installs the pinned
openclaw-memory-atmem@2.3.8-beta.6 bridge; do not install the bridge directly.

Restore and migration behavior

atmem restore hermes --yes

Restore disables the scoped binding and restores the provider recorded in the
setup receipt. The pre-switch Hermes configuration is retained in an encrypted,
hash-verified backup. Restore refuses to overwrite later user edits.

Existing MEMORY.md and USER.md content is never silently admitted into
governed memory. Supported content becomes quarantined proposals for review;
the original files remain unchanged. Re-running with the same memory scope is
idempotent. To change between isolated and shared memory, restore first and then
run setup with the new scope. Interrupted lifecycle evidence is retained in a
durable local spool and retried after a service restart.

Compatibility and honest limits

• Verified end to end on macOS with Hermes Agent 0.21.5. Linux and WSL use the
  same local file/provider contract but remain unqualified in this beta. Native
  Windows credential ACL support remains an explicit follow-up target.
• Isolated memory is the default. Shared memory requires --memory shared.
• Context injection requires --activate; shadow mode intentionally withholds it.
• --verify-turn uses and then deletes a random temporary fact. It proves the
  installed route and completed five-event lifecycle, not every future model answer.
• AtFlows is optional for memory. Install 0.1.4b3 to capture bounded native Hermes
  model/tool metadata in a distinct service bucket; cost is unknown when Hermes
  does not report usable token/model data.
• No database migration is required. Setup does not delete existing memories,
  proposals, evidence, or Hermes files.