Optional delegated context authority

Native AtMem retrieval remains the default. Delegated mode is for a deployment where a compatible local provider must remain the sole context-decision authority for selected users, agents, and workspaces. AtMem then verifies the signed decision, passes the exact context to the host once, and records authorization and delivery as separate evidence.

Delegation changes only who selects context for a matching turn. It does not move canonical memory into AtMem, import the provider's database, or give AtMem access to the provider's internals. The provider is not bundled with AtMem; the operator runs a compatible provider separately on the same computer.

Choose the authority mode

Use native mode unless another product must remain the context authority. Delegated mode is not required to use AtBot, semantic retrieval, OpenClaw, Pydantic AI, or LangGraph.

Requirements

• AtMem and the relevant host adapter must already be installed and verified.
• Context injection requires AtMem control mode to be active; shadow mode never injects context.
• The provider must implement the closed v1 request/result contracts and hold the private half of an Ed25519 signing key.
• AtMem receives the base64 public key, a request key ID/private secret-file reference, and a numeric loopback HTTP endpoint such as 127.0.0.1. Remote endpoints and wildcard scopes are rejected in this beta.
• The host must supply an authenticated user_id. Prompt text, a memory subject, or an agent-generated claim cannot establish user identity.

Set up a delegated provider

Obtain the provider version, instance ID, key ID, base64 Ed25519 public key, request-credential references, and loopback endpoint. Keep the provider's request secret in its private mode-0600 file; never paste its bytes. Find the governed workspace ID with atmem control agents --json, then register exact scopes:

atmem delegated register \
  --provider-id context-provider \
  --provider-version 1.0 \
  --instance-id local \
  --key-id primary \
  --public-key-file ./provider.pub \
  --request-key-id REQUEST_KEY_ID --request-secret-file /absolute/private/request.key \
  --endpoint http://127.0.0.1:8788/v1/delegated-context \
  --workspace ws_123 \
  --agent main \
  --user local-owner

Registration does not activate delegation. Check it, then opt in:

atmem delegated status
atmem delegated self-test
atmem delegated enable context-provider:local
atmem delegated doctor

self-test verifies local signature/configuration primitives and runs doctor. doctor checks the configured scope and authenticated provider health. Its state is one of:

• unconfigured: no trust registration exists;
• registered_disabled: trust exists, but native AtMem remains authoritative;
• migration_required: configure request credentials before enabling or making delegated calls;
• ready: an enabled provider passed authenticated health for its registered identity;
• degraded: delegation is enabled, but the provider cannot be reached.

The dashboard exposes the same state and actions under Settings → Context authority. The dashboard and CLI modify the same private configuration file; neither is a separate source of truth.

For OpenClaw, map the opaque authenticated user in the bridge configuration:

{
  "delegatedContext": {
    "userId": "local-owner",
    "requireOwner": true
  }
}

This mapping does not enable delegation. The AtMem registration is the single activation switch. If OpenClaw cannot prove the sender is the owner, AtMem withholds delegated context.

Isolated local CLI identity (2.2.6)

requireOwner: false alone no longer grants a user identity. Existing users of that bypass must restore the default owner gate or configure a dedicated local mapping. This is an intentional fail-closed tightening; it does not change the HMAC profile or delegated payload. Native-only installations are unaffected.

For a dedicated single-operator CLI process, with shared channels disabled and no untrusted users able to submit turns, an operator may explicitly configure:

{
  "agentWorkspaces": { "main": "/absolute/isolated-workspace" },
  "delegatedContext": {
    "userId": "local-owner",
    "requireOwner": false,
    "localOperator": {
      "isolated": true,
      "stateDir": "/absolute/private-openclaw-state",
      "agentId": "main",
      "workspaceDir": "/absolute/isolated-workspace",
      "sessionKey": "EXACT_HOST_SESSION_KEY",
      "sessionId": "EXACT_HOST_SESSION_GENERATION"
    }
  }
}

Use actual host identifiers, not model text. Agent, absolute workspace, session key/generation and run ID must match, with no channel/account/chat/sender metadata. An explicit non-owner result always refuses. Session reset requires rebinding.

When messageProvider: "cli" is absent, set OPENCLAW_STATE_DIR to the configured stateDir: an absolute, non-symlink directory owned by the current OS user with mode 0700. Run openclaw agent --local with no delivery/channel/recipient flags; the effective host configuration must have no configured channels. The mapping is a deliberate local trust assertion and cannot protect against a hostile process running as the same OS user. Never configure it on a shared gateway. Missing scope or unverified process origin fails closed. requireOwner: false and the complete mapping are both required; the default owner gate is unchanged.

Logs distinguish identity failures from provider authentication failures. Real Mem0/Claude CLI acceptance passes on OpenClaw 2026.9.2 and 2026.9.3; see the compatibility matrix.

After changing the OpenClaw bridge configuration, verify the complete path:

atmem openclaw upgrade
atmem control verify
atmem delegated doctor

The delegatedContext block only maps authenticated host identity. Do not add another delegation enable flag to the host configuration.

Complete request and return path

User query
  → host adapter sends query + run/turn/session/agent/user/workspace binding
  → AtMem matches an explicitly enabled trust registration
  → AtMem sends the request to the loopback provider
  → provider returns a signed inject or withhold result
  → AtMem validates identity, scope, time, bytes, receipt and replay state
  → AtMem reserves the turn and suppresses native context preparation
  → host adapter inserts one exact context segment, or inserts nothing
  → host model receives its input
  → adapter confirms the exact delivered segment at the model-input boundary
  → AtMem records provider authorization separately from delivery
  → answer returns to the user

AtMem never performs native retrieval after an accepted delegated inject or withhold decision. The provider cannot authorize a different turn by changing an ID, reuse a nonce, introduce its own public key, or cause both native and delegated memory context to be injected.

Turn behavior

For a matching scope:

1. AtMem sends the query and authenticated turn binding to the loopback provider.
2. AtMem validates the closed contract, time window, scope, hashes, replay state, and Ed25519 signature.
3. An inject result becomes the only memory-context contribution for the turn.
4. A withhold result contributes nothing.
5. AtMem confirms the exact segment at model input and records delivery evidence.

AtMem never persists the delegated query or context bytes. It retains bounded identifiers, digests, provider attribution, receipt correlation, the decision, and delivery state. Provider failure is fail-closed. Native fallback is possible only when --native-fallback was explicitly set during registration, and the result is labeled as AtMem-authorized fallback rather than delegated context.

Inspect what happened

Use the dashboard Evidence view for the human-readable flight story, or use the CLI for machine-readable verification:

atmem blackbox runs
atmem blackbox verify RUN_ID
atmem delegated status --json

For a delegated injection, evidence distinguishes:

1. the provider authorized exact bytes for the bound turn;
2. AtMem accepted the signed result and requested delivery;
3. the OpenClaw adapter observed exactly one matching segment at llm_input;
4. the model produced output afterward.

Authorization alone is not delivery proof, and delivery does not prove that the model followed the context or that a real-world action succeeded.

Failure behavior

Do not work around a failure by widening user, agent, or workspace scopes. A provider response cannot register itself or replace its trusted key.

Disable, remove, or rotate trust

Disable or remove the integration safely:

atmem delegated disable context-provider:local
atmem delegated remove context-provider:local --yes

Disabling affects later turns immediately and leaves historical evidence unchanged. Removal is allowed only after disabling. To rotate the public key, disable the registration, replace it with the new key and key ID, inspect the new fingerprint, run the checks, and explicitly enable it again:

atmem delegated disable context-provider:local
atmem delegated register --replace \
  --provider-id context-provider --provider-version 1.0 --instance-id local \
  --key-id rotated-2026-09 --public-key-file ./provider-rotated.pub \
  --request-key-id REQUEST_KEY_ID --request-secret-file /absolute/private/request.key \
  --endpoint http://127.0.0.1:8788/v1/delegated-context \
  --workspace ws_123 --agent main --user local-owner
atmem delegated status
atmem delegated enable context-provider:local
atmem delegated doctor

Provider implementers

Implement the request schema and the signed result contract. Implement the authenticated HTTP profile for context and health before provider memory/model access. That profile also defines request-secret rotation and guided migration from beta 3/beta 9 and is required by beta 10. The contract directory includes signed inject/withhold examples and all positive, negative, and stateful conformance vectors. Treat the request deadline as a hard bound and return the exact binding unchanged.

The complete wire format and claim boundary are in the v1 contract.

Built-in optional provider adapters

AtMem includes a shared provider runtime plus independently installable Mem0, LangGraph, and Pydantic AI adapters. They emit this same v1 contract and do not receive special trust or bypass verification. Start with the context-provider adapter guide, or inspect all commands locally:

atmem provider --help
atmem provider init --help