AtMem 2.3.6 — memory-integrity controls and portable locking

AtMem 2.3.6 is the stable promotion of the clean-clone reproduced 2.3.6b1 candidate. It strengthens three canonical-memory boundaries identified by the public Memory Integrity Benchmark and incorporates portable Windows-safe file locking. The published stable wheel repeated the 700-trial campaign with 400 PASS, 300 honestly NOT_REPRESENTABLE, zero FAIL, and zero ERROR.

Install or upgrade

python -m pip install --upgrade atmem==2.3.6
atmem --version
atmem init
atmem status

The matching OpenClaw bridge is openclaw-memory-atmem@2.3.6. Existing OpenClaw users should refresh and verify it:

atmem openclaw upgrade
atmem control verify --probe

AtBot remains atmem-atbot==0.1.0, AtFlows remains atflows==0.1.2, and Python 3.10–3.13 remains supported.

When a healthy managed AtFlows instance is detected, its validated local link now appears in AtMem's persistent top navigation instead of the footer. The link remains hidden before sign-in and when no safe loopback endpoint is available.

What changed from 2.3.5

Secret-bearing semantic proposals are refused

Memory.submit_proposal now screens fact text, fact keys, and entities before creating a canonical semantic record. A rejected proposal creates no active or quarantined memory record. Its admission and audit result remain inspectable, while the rejected-proposal ledger retains structural identifiers and digests rather than content-bearing fields.

This is a semantic-memory boundary. Full-fidelity source and protocol evidence may still retain exactly what a host supplied under AtMem's governed evidence policy; semantic refusal is not represented as deletion of source evidence.

Derived memories preserve direct-parent taint

Proposals that name related_record_ids now persist those parents and inherit their taint. Any untrusted or tainted direct parent forces the derived record into quarantine with DERIVED_FROM_TAINTED, even when the immediate source is authenticated. Parents must match the exact subject, agent, and workspace.

This is explicit direct-parent propagation, not graph-wide inferred information-flow analysis.

Procedures require issued review authority

Typed procedure approval now requires instance-bound authorization issued by AtMem from configured reviewer policy. Principal, operation, subject, agent, workspace, nonce, and active instance are checked when the decision settles. Caller-created authorization objects, cross-instance reuse, replay, widened scope, and plain actor labels fail closed.

The authenticated Administrator dashboard uses this boundary. Embedded users configure review_authorities and call Memory.issue_review_authorization. The generic CLI continues to review ordinary proposals but refuses procedure decisions because it has no authenticated identity session.

Portable process-reentrant locking

Storage, control-state, and delegated-transport locks use one process-reentrant implementation backed by flock on POSIX and msvcrt.locking on Windows. Optional O_NOFOLLOW and O_NONBLOCK flags remain active where supported. Native Windows CI exercises CLI import, nested locking, remember, and recall.

Memory Integrity Benchmark result

The stable 2.3.6 wheel was installed from its published SHA-256-pinned PyPI artifact and run for 100 trials in each of seven categories:

AtMem therefore passed 400/400 trials for controls the harness could represent, with zero failed or errored trials. By simple native-category coverage this would place AtMem second among the currently published systems, behind the benchmark author's LLMBASEDOS result and ahead of Mem0 and Letta. This is not an official leaderboard position until the upstream maintainers accept the submission. The adapter and complete evidence package are now in upstream PR #1.

AtMem is not first because Harness Specification v1 supplies caller-controlled principal labels rather than an authenticated AtMem review authorization. It would be unsafe and misleading for the adapter to turn those labels into approval authority merely to gain three passes. The exact evidence, comparison, and limitation are documented in the Memory Integrity Benchmark report.

The stable run contains 700 trials: 400 PASS, 300 NOT_REPRESENTABLE, zero FAIL, and zero ERROR. Publication validation and every evidence checksum pass. Its run identity is atmem-v2.3.6-seed-20260922; prerelease evidence was not relabelled as a stable run.

Migration and compatibility

• No database schema migration is required.
• Existing records, evidence, audit events, identities, and Home layout remain intact.
• Existing secret-bearing records created by earlier releases are not silently removed. Inspect and forget them through governed lifecycle operations.
• Non-procedure review integrations remain compatible. Procedure approvers must adopt issued review authorization.
• Retrieval, graph, AtBot, AtFlows, and egress defaults are unchanged.
• Source evidence can retain input that semantic memory refuses; evidence access, retention, export, and deletion remain separately governed.

Known limitations

• Purpose-scoped recall is not implemented or claimed by this release.
• Taint propagation follows explicit direct parents; it does not infer hidden semantic dependencies or arbitrary graph-wide flows.
• Reviewer configuration is local application policy, not a federated identity protocol.
• The benchmark measures seven narrow memory-integrity controls, not retrieval quality, latency, complete product security, compliance, or certification.

To return to 2.3.5:

python -m pip install --upgrade atmem==2.3.5
atmem openclaw upgrade

Downgrading changes executable behavior; it does not rewrite records created while 2.3.6 was installed.