AtMem 2.3.0 — encrypted, portable Agent Black Box

Publication cancelled. The public source tag was created, but package and GitHub Release publication was stopped because it depended on prerelease AtBot 0.1.0a6. Do not install this version. Use stable AtMem 2.3.1, which pins stable atmem-atbot==0.1.0.

AtMem 2.3.0 is the stable release of the standalone encrypted Agent Black Box introduced after 2.2.6. It changes the product from primarily content-minimizing memory-control evidence into an operator-selectable recorder whose default is exact, encrypted, full-fidelity capture of the boundaries the connected agent supplies.

What changed since 2.2.6

Exact encrypted session evidence

• New installations record exact host-observed prompts, model input/output, memory context, tool names, arguments, targets, results and errors by default.
• Ordered image, audio, video and document bytes are copied into AtMem before exact capture is acknowledged. Current OpenClaw media, managed inbound references and supported legacy attachment shapes are covered.
• The run inspector renders authorized images and audio/video playback, identifies all observed input modalities, and provides plaintext artifact download only to Evidence Collector and Administrator.
• Metadata-only and recorder-off modes remain available in one compact setting. Historical hash-only evidence is still readable but cannot be reconstructed.

Four local access levels

• Viewer: content-free event metadata, hashes, coverage and integrity.
• Investigator: Viewer access plus in-application decryption, viewing, playback and reconstruction.
• Evidence Collector: Investigator access plus plaintext download/export and evidence-recorder controls.
• Administrator: ultimate local access plus account management, password reset, recovery, restore and home adoption.

atmem init creates the first local Administrator and prints a one-time temporary password. The dashboard signs in with a username and password, immediately asks the first Administrator to choose a new password, and supports compact user management. Passwords may be any non-empty value; AtMem does not impose an enterprise password policy on a loopback local installation.

One portable AtMem Home

Memory, encrypted evidence, identities, keys, configuration, multimodal artifacts, migration receipts and runtime state now resolve from one home. Precedence is --home, then ATMEM_HOME, then ~/.atmem.

New commands:

atmem home status
atmem home verify
atmem home snapshot /path/to/verified-copy
atmem restore /path/to/copied-home
atmem home migrate --home ~/.atmem /path/to/portable-home
atmem home adopt --home /path/to/portable-home

A copied home opens read-only first and discloses no account or evidence content before login. An Administrator from that copied home can verify and reconstruct it, then adopt it. Adoption rotates sessions and writes machine-local bindings and a receipt; historical evidence is not rewritten. Migration is copy-first, journaled, restartable and never deletes its source automatically.

Retrieval and agent evidence fixes

• Direct-support retrieval now preserves fact-key matches for personal questions; a request such as “for my age” can retrieve an authorized age fact even without generic lexical overlap, without enabling unrelated persona injection.
• The OpenClaw bridge durably spools execution evidence, reports complete observed request modalities, preserves sparse attachment bindings, hashes the delivered context envelope consistently, and confirms exact injection at llm_input.
• Audit and run views are stable, human-readable, and retain technical proof behind explicit disclosure rather than substituting IDs for the actual diagnosis.
• The Sessions view now starts with outcome, failure, tool-error and evidence-gap rates plus seven-day health. Selecting a recent or archived session opens a focused master/detail view with Summary, Findings and Timeline tabs; zooming out restores the prior list and keyboard focus.

Delegated and framework context

The 2.2.6 delegated-context contracts remain wire-compatible. Per-instance HMAC authenticates the exact request and health check; expiry and replay are rejected before provider access; provider results remain Ed25519-signed and scope-bound. Native AtMem memory remains the default. Delegation stays opt-in and suppresses native recall only for an enabled, exact-scope provider match.

Pydantic AI and LangChain/LangGraph retain native and delegated context delivery. Their adapters share the selected AtMem Home and unchanged JSON contracts. The installed full-fidelity multimodal host profile in this release is OpenClaw; the other framework adapters do not claim every OpenClaw capture hook.

Install or upgrade

New installation:

python -m pip install atmem==2.3.0
atmem atbot setup
atmem init
atmem dashboard

Upgrade from 2.2.6 or an earlier supported 2.x package:

python -m pip install --upgrade atmem==2.3.0
atmem openclaw upgrade       # when OpenClaw is connected
atmem control verify
atmem home status

For Pydantic AI or LangChain/LangGraph:

python -m pip install --upgrade 'atmem[pydantic-ai]==2.3.0'
python -m pip install --upgrade 'atmem[langgraph]==2.3.0'

AtMem continues to install the compatible atmem-atbot==0.1.0a6 companion. Do not install AtBot separately. atmem openclaw upgrade installs the matching openclaw-memory-atmem@2.3.0 bridge.

Migration and opt-in behavior

• Existing memory/control databases remain supported in place. AtMem does not silently move a legacy layout or delete it.
• To gain one-folder portability, stop AtMem and connected writers, migrate into a new destination, verify it, then commit/adopt it. Keep the source until the target has been independently inspected.
• Existing capture choices are preserved. New configured recorders default to full encrypted capture. Changing to metadata-only affects new events only.
• Delegated providers and Governed Task State remain explicitly enabled features; upgrading does not grant a provider authority or enable task context.
• Existing delegated registrations keep their v1 request/result JSON. Registrations created before authenticated transport must be migrated to a per-instance HMAC request credential before enablement.

Compatibility

• Python 3.10–3.13.
• AtBot 0.1.0a6 (unchanged, exact dependency).
• OpenClaw bridge 2.3.0; the release gate builds, typechecks and runs hook/smoke tests against the locked host, with the latest-host declaration fixture reviewed against OpenClaw 2026.9.4 on 13 September 2026.
• Pydantic AI, LangChain/LangGraph and optional Mem0 2.x provider dependencies are installed only through their extras and tested independently of the base wheel.
• Delegated provider request/result JSON contracts remain unchanged from 2.2.6.

Honest limitations

AtMem records what the connected agent reports at its supported boundaries. It does not independently prove that a website, purchase, email, payment or other external side effect occurred unless separately verified evidence is attached. Missing hooks remain unknown. Exact capture cannot recover content that a host never supplied or retroactively expand historical digest-only events.

The portable home is local and single-writer; it is not cloud synchronization or multi-primary replication. Copy only after stopping writers or use home snapshot. The vault streams and deduplicates large artifacts, but release tests use bounded fixtures rather than physically allocating a 10 GiB file. Recipient post-quantum export requires its optional cryptographic backend; local storage uses AtMem's documented authenticated symmetric encryption and application authorization.

Measured end-user usability is not claimed. The dashboard has responsive static and browser interaction regressions, but the independent two-cohort usability protocol remains future work.