Open Memory Lab 0.6.0

Install

Docker (Postgres + oml-server):

curl -fsSLO https://raw.githubusercontent.com/e8kor/open-memory-lab/v0.6.0/docker-compose.yml
OML_VERSION=0.6.0 docker compose up -d

Then follow the quickstart in the README to claim the server and issue keys.

On a new volume, compose creates two database roles: oml_owner, which owns the
database and runs the migrations through OML_POSTGRES__OWNER_URL, and
oml_server, which owns nothing and serves through OML_POSTGRES__URL. Postgres
runs its init scripts only on an empty volume, so a volume an earlier release
created holds neither role: split it once before this release starts, as decision d7 of
https://e8kor.github.io/open-memory-lab/adr/ADR-0034-the-lead-serves-as-a-role-that-owns-nothing/
describes. The server refuses to start while both URLs log in as one role.

The agent plugin for Claude Code:

claude plugin marketplace add e8kor/open-memory-lab
claude plugin install oml@open-memory-lab

To install exactly this release, pin the marketplace to its tag with
claude plugin marketplace add e8kor/open-memory-lab#v0.6.0, or verify
oml-marketplace-0.6.0.json, whose sources are this repository at v0.6.0
and its commit, and add it from a directory:

mkdir -p oml-marketplace/.claude-plugin
cp oml-marketplace-0.6.0.json oml-marketplace/.claude-plugin/marketplace.json
claude plugin marketplace add ./oml-marketplace

Offline: verify and extract oml-claude-plugins-0.6.0.tar.gz (or .zip), then
claude plugin marketplace add ./oml-claude-plugins-0.6.0 and install as above.

Other agent tools: oml-agent-kit-0.6.0.tar.gz (or .zip) holds MCP
configurations for OpenAI Codex CLI, Cursor, Gemini CLI, VS Code and Claude Desktop,
an AGENTS.md block, and a Gemini CLI session-start hook; its README says what each
tool's documentation does and does not settle.

Image: ghcr.io/e8kor/open-memory-lab:0.6.0 (ghcr.io/e8kor/open-memory-lab@sha256:f4250d8e24f9ba03735f55dba4d0fd0fdb74a357728d5fe1f3316e1cde169ca8), one index for
linux/amd64 and linux/arm64.

The oml CLI: oml-cli-0.6.0-<target>.tar.gz for x86_64-unknown-linux-musl,
aarch64-unknown-linux-musl (static, any distribution), and
oml-cli-0.6.0-x86_64-pc-windows-msvc.zip. No macOS build in this release: macOS
targets are paused; on a Mac, build the CLI from source with cargo install.
The server: oml-server-lead-0.6.0-<target>.tar.gz for x86_64-unknown-linux-gnu
and aarch64-unknown-linux-gnu.
The lake writer, a separate service run on its own (docs/operations/lake.md):
oml-lakewriter-0.6.0-<target>.tar.gz for x86_64-unknown-linux-gnu and
aarch64-unknown-linux-gnu.

Verify

Every archive, SBOM, the pinned marketplace and SHA256SUMS here, and the image, are
signed keyless by this release workflow; the image's signature is on the index digest, and each platform image
is signed too:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
  ghcr.io/e8kor/open-memory-lab@sha256:f4250d8e24f9ba03735f55dba4d0fd0fdb74a357728d5fe1f3316e1cde169ca8

Verify an archive, then extract it (Linux):

cosign verify-blob \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
  --bundle oml-cli-0.6.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
  oml-cli-0.6.0-x86_64-unknown-linux-musl.tar.gz
tar -xzf oml-cli-0.6.0-x86_64-unknown-linux-musl.tar.gz

On Windows, in PowerShell:

cosign verify-blob `
  --certificate-oidc-issuer https://token.actions.githubusercontent.com `
  --certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' `
  --bundle oml-cli-0.6.0-x86_64-pc-windows-msvc.zip.sigstore.json `
  oml-cli-0.6.0-x86_64-pc-windows-msvc.zip
Expand-Archive oml-cli-0.6.0-x86_64-pc-windows-msvc.zip -DestinationPath .

SHA256SUMS lists every archive, SBOM and the pinned marketplace; verify its bundle the
same way, then sha256sum --check --ignore-missing SHA256SUMS.

Each binary has a CycloneDX SBOM (*.cdx.json), generated from the committed Cargo.lock.

Kubernetes

The Helm chart runs this release's one lead, with Postgres you bring through a Secret
that holds two URLs: OML_POSTGRES__OWNER_URL for the role that owns the database and
runs the migrations, and OML_POSTGRES__URL for the role the lead serves under, which
owns nothing. Each role holds LOGIN alone:

kubectl create namespace oml
kubectl --namespace oml create secret generic oml-postgres \
  --from-literal=OML_POSTGRES__URL='postgres://SERVING_ROLE:PASSWORD@HOST:5432/DATABASE' \
  --from-literal=OML_POSTGRES__OWNER_URL='postgres://OWNER_ROLE:PASSWORD@HOST:5432/DATABASE'
helm install oml https://github.com/e8kor/open-memory-lab/releases/download/v0.6.0/oml-0.6.0.tgz \
  --namespace oml --create-namespace --set image.digest=sha256:f4250d8e24f9ba03735f55dba4d0fd0fdb74a357728d5fe1f3316e1cde169ca8

Claim the first admin key through kubectl port-forward before you enable any Ingress;
the install notes print the commands. Verify the archive before installing it:

cosign verify-blob \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/e8kor/open-memory-lab/\.github/workflows/release\.yml@refs/tags/.*$' \
  --bundle oml-0.6.0.tgz.sigstore.json \
  oml-0.6.0.tgz