Repository navigation
Releases
Open Memory Lab 0.6.2
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.6.2/docker-compose.yml
OML_VERSION=0.6.2 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.6.2, or verify
oml-marketplace-0.6.2.json, whose sources are this repository at v0.6.2
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.6.2.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.6.2.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.6.2 and install as above.
Other agent tools: oml-agent-kit-0.6.2.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.6.2 (ghcr.io/e8kor/open-memory-lab@sha256:e032a4eb8ae6846e983a05679d586f78a5649caadb62728069a515ebca9afb26), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.6.2-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.6.2-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.6.2-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
The lake writer, a separate service run on its own (docs/operations/lake.md):
oml-lakewriter-0.6.2-<target>.tar.gz for x86_64-unknown-linux-gnu and
aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:e032a4eb8ae6846e983a05679d586f78a5649caadb62728069a515ebca9afb26
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.6.2-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.6.2-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.6.2-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.6.2-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.6.2-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.6.2-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.6.2/oml-0.6.2.tgz \
--namespace oml --create-namespace --set image.digest=sha256:e032a4eb8ae6846e983a05679d586f78a5649caadb62728069a515ebca9afb26
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.6.2.tgz.sigstore.json \
oml-0.6.2.tgz
Open Memory Lab 0.6.1
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.6.1/docker-compose.yml
OML_VERSION=0.6.1 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.6.1, or verify
oml-marketplace-0.6.1.json, whose sources are this repository at v0.6.1
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.6.1.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.6.1.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.6.1 and install as above.
Other agent tools: oml-agent-kit-0.6.1.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.6.1 (ghcr.io/e8kor/open-memory-lab@sha256:b257b55dc1bd06890734090d1ef9b5a5d99e75c8a43ede8b1e9e5305d11d35ba), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.6.1-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.6.1-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.6.1-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
The lake writer, a separate service run on its own (docs/operations/lake.md):
oml-lakewriter-0.6.1-<target>.tar.gz for x86_64-unknown-linux-gnu and
aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:b257b55dc1bd06890734090d1ef9b5a5d99e75c8a43ede8b1e9e5305d11d35ba
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.6.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.6.1-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.6.1-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.6.1-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.6.1-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.6.1-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.6.1/oml-0.6.1.tgz \
--namespace oml --create-namespace --set image.digest=sha256:b257b55dc1bd06890734090d1ef9b5a5d99e75c8a43ede8b1e9e5305d11d35ba
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.6.1.tgz.sigstore.json \
oml-0.6.1.tgz
Open Memory Lab 0.6.0
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.6.0/docker-compose.yml
OML_VERSION=0.6.0 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.6.0, or verify
oml-marketplace-0.6.0.json, whose sources are this repository at v0.6.0
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.6.0.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.6.0.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.6.0 and install as above.
Other agent tools: oml-agent-kit-0.6.0.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.6.0 (ghcr.io/e8kor/open-memory-lab@sha256:f4250d8e24f9ba03735f55dba4d0fd0fdb74a357728d5fe1f3316e1cde169ca8), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.6.0-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.6.0-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.6.0-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
The lake writer, a separate service run on its own (docs/operations/lake.md):
oml-lakewriter-0.6.0-<target>.tar.gz for x86_64-unknown-linux-gnu and
aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:f4250d8e24f9ba03735f55dba4d0fd0fdb74a357728d5fe1f3316e1cde169ca8
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.6.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.6.0-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.6.0-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.6.0-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.6.0-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.6.0-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.6.0/oml-0.6.0.tgz \
--namespace oml --create-namespace --set image.digest=sha256:f4250d8e24f9ba03735f55dba4d0fd0fdb74a357728d5fe1f3316e1cde169ca8
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.6.0.tgz.sigstore.json \
oml-0.6.0.tgz
Open Memory Lab 0.5.8
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.8/docker-compose.yml
OML_VERSION=0.5.8 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.8, or verify
oml-marketplace-0.5.8.json, whose sources are this repository at v0.5.8
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.8.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.8.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.8 and install as above.
Other agent tools: oml-agent-kit-0.5.8.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.8 (ghcr.io/e8kor/open-memory-lab@sha256:824c6d988c8ec37dd51f354f3d1e306ab7ddff0d93fd4d6d65c96703d77e244e), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.8-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.5.8-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.5.8-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:824c6d988c8ec37dd51f354f3d1e306ab7ddff0d93fd4d6d65c96703d77e244e
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.8-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.8-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.8-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.8-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.8-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.8-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.8/oml-0.5.8.tgz \
--namespace oml --create-namespace --set image.digest=sha256:824c6d988c8ec37dd51f354f3d1e306ab7ddff0d93fd4d6d65c96703d77e244e
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.8.tgz.sigstore.json \
oml-0.5.8.tgz
Open Memory Lab 0.5.7
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.7/docker-compose.yml
OML_VERSION=0.5.7 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.7, or verify
oml-marketplace-0.5.7.json, whose sources are this repository at v0.5.7
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.7.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.7.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.7 and install as above.
Other agent tools: oml-agent-kit-0.5.7.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.7 (ghcr.io/e8kor/open-memory-lab@sha256:3f2c7fe99de1466958b0cdf6898fc35ed3afd69fd9dd725d248cfc8348a91145), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.7-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.5.7-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.5.7-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:3f2c7fe99de1466958b0cdf6898fc35ed3afd69fd9dd725d248cfc8348a91145
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.7-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.7-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.7-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.7-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.7-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.7-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.7/oml-0.5.7.tgz \
--namespace oml --create-namespace --set image.digest=sha256:3f2c7fe99de1466958b0cdf6898fc35ed3afd69fd9dd725d248cfc8348a91145
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.7.tgz.sigstore.json \
oml-0.5.7.tgz
Open Memory Lab 0.5.6
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.6/docker-compose.yml
OML_VERSION=0.5.6 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.6, or verify
oml-marketplace-0.5.6.json, whose sources are this repository at v0.5.6
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.6.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.6.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.6 and install as above.
Other agent tools: oml-agent-kit-0.5.6.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.6 (ghcr.io/e8kor/open-memory-lab@sha256:53d5208cb0448e262d717fadc8194bd6eb9ad939b12badceb9e4a5e9f9a1757e), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.6-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.5.6-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.5.6-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:53d5208cb0448e262d717fadc8194bd6eb9ad939b12badceb9e4a5e9f9a1757e
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.6-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.6-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.6-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.6-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.6-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.6-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.6/oml-0.5.6.tgz \
--namespace oml --create-namespace --set image.digest=sha256:53d5208cb0448e262d717fadc8194bd6eb9ad939b12badceb9e4a5e9f9a1757e
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.6.tgz.sigstore.json \
oml-0.5.6.tgz
Open Memory Lab 0.5.5
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.5/docker-compose.yml
OML_VERSION=0.5.5 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.5, or verify
oml-marketplace-0.5.5.json, whose sources are this repository at v0.5.5
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.5.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.5.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.5 and install as above.
Other agent tools: oml-agent-kit-0.5.5.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.5 (ghcr.io/e8kor/open-memory-lab@sha256:dc4075b4b50d03b8a4aa841dd83c285e13d5995f7c3ed344a9260352b5138a12), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.5-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.5.5-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.5.5-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:dc4075b4b50d03b8a4aa841dd83c285e13d5995f7c3ed344a9260352b5138a12
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.5-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.5-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.5-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.5-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.5-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.5-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.5/oml-0.5.5.tgz \
--namespace oml --create-namespace --set image.digest=sha256:dc4075b4b50d03b8a4aa841dd83c285e13d5995f7c3ed344a9260352b5138a12
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.5.tgz.sigstore.json \
oml-0.5.5.tgz
Open Memory Lab 0.5.4
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.4/docker-compose.yml
OML_VERSION=0.5.4 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.4, or verify
oml-marketplace-0.5.4.json, whose sources are this repository at v0.5.4
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.4.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.4.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.4 and install as above.
Other agent tools: oml-agent-kit-0.5.4.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.4 (ghcr.io/e8kor/open-memory-lab@sha256:5976b57897d562db0cec209815e46c06b328399f969d29086ee43e4a5628b49a), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.4-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.5.4-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.5.4-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:5976b57897d562db0cec209815e46c06b328399f969d29086ee43e4a5628b49a
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.4-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.4-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.4-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.4-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.4-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.4-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.4/oml-0.5.4.tgz \
--namespace oml --create-namespace --set image.digest=sha256:5976b57897d562db0cec209815e46c06b328399f969d29086ee43e4a5628b49a
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.4.tgz.sigstore.json \
oml-0.5.4.tgz
Open Memory Lab 0.5.3
Do not upgrade an existing v0.5.1 or earlier server to this release. Its migration 0017 refuses to run on a database created before v0.5.2 (
check constraint "workareas_universe_committed" ... is violated) and the server does not start. The migration rolls back, so returning to the previous binary is safe. Fresh installs are unaffected. A fixed release follows as v0.5.4.
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.3/docker-compose.yml
OML_VERSION=0.5.3 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.3, or verify
oml-marketplace-0.5.3.json, whose sources are this repository at v0.5.3
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.3.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.3.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.3 and install as above.
Other agent tools: oml-agent-kit-0.5.3.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.3 (ghcr.io/e8kor/open-memory-lab@sha256:6134252e398e1af0aefd192ae395b9b3e70887734d13fc655ff4c6a449af0d8f), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.3-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.5.3-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.5.3-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:6134252e398e1af0aefd192ae395b9b3e70887734d13fc655ff4c6a449af0d8f
Verify an archive, then extract it (Linux):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.3-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.3-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.3-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.3-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.3-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.3-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.3/oml-0.5.3.tgz \
--namespace oml --create-namespace --set image.digest=sha256:6134252e398e1af0aefd192ae395b9b3e70887734d13fc655ff4c6a449af0d8f
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.3.tgz.sigstore.json \
oml-0.5.3.tgz
Open Memory Lab 0.5.1
Install
Docker (Postgres + oml-server):
curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.5.1/docker-compose.yml
OML_VERSION=0.5.1 docker compose up -d
Then follow the quickstart in the README to claim the server and issue keys.
On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.
The agent plugin for Claude Code:
claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab
To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.5.1, or verify
oml-marketplace-0.5.1.json, whose sources are this repository at v0.5.1
and its commit, and add it from a directory:
mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.5.1.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace
Offline: verify and extract oml-claude-plugins-0.5.1.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.5.1 and install as above.
Other agent tools: oml-agent-kit-0.5.1.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.
Image: ghcr.io/e8kor/open-memory-lab:0.5.1 (ghcr.io/e8kor/open-memory-lab@sha256:f9133d337bb60ff21481d5dec09d1f56c323f5c6f0e742f3cf8853fa79c95eab), one index for
linux/amd64 and linux/arm64.
The oml CLI: oml-cli-0.5.1-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), aarch64-apple-darwin and
x86_64-apple-darwin, and oml-cli-0.5.1-x86_64-pc-windows-msvc.zip.
The server: oml-server-lead-0.5.1-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
Verify
Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
ghcr.io/e8kor/open-memory-lab@sha256:f9133d337bb60ff21481d5dec09d1f56c323f5c6f0e742f3cf8853fa79c95eab
Verify an archive, then extract it (Linux; on macOS the same, with that target's name):
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-cli-0.5.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
oml-cli-0.5.1-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.5.1-x86_64-unknown-linux-musl.tar.gz
On Windows, in PowerShell:
cosign verify-blob `
--certificate-oidc-issuer https://token.actions.githubusercontent.com `
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
--bundle oml-cli-0.5.1-x86_64-pc-windows-msvc.zip.sigstore.json `
oml-cli-0.5.1-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.5.1-x86_64-pc-windows-msvc.zip -DestinationPath .
SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.
Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.
Kubernetes
The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:
kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
--from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
--from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.5.1/oml-0.5.1.tgz \
--namespace oml --create-namespace --set image.digest=sha256:f9133d337bb60ff21481d5dec09d1f56c323f5c6f0e742f3cf8853fa79c95eab
Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:
cosign verify-blob \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
--bundle oml-0.5.1.tgz.sigstore.json \
oml-0.5.1.tgz