v0.1.0-rc.12

The twelfth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. This
release brings:

• a security pass over everything rc.11 shipped;
• fairer licence charging;
• the CI gate for pull requests, with or without access to the cluster;
• jobs for six CI systems;
• a team space;
• an engine that reads a 2,000-node cluster in seconds and keeps 174 of 175 promises on a planted benchmark;
• macOS downloads signed with a Developer ID and checked by Apple's notary service.

A copy of rc.11 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key
first.

shoalcheck preflight drain node-1 node-2   # can these nodes be evacuated together? exit 0 · 2 · 1
shoalcheck gate --with ./rendered/         # what would this pull request's manifests change on the cluster?
shoalcheck findings -o junit               # the reading as a test report your CI already renders
shoalcheck team init ./team --name Alice   # a shared team space: a folder you share, no service of ours
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

Security

• Toolchain and modules.

  • rc.11 was built with Go 1.26.2. govulncheck found 29 known vulnerabilities its code could reach, among them
    html/template fixes on the report path.
  • This release is built with Go 1.26.10 and patched modules, and govulncheck reports none.
  • Every build is now checked with govulncheck.

• Release files no longer name the machine that built them. Release binaries carry no build-machine paths,
  and every file in an archive is owned by root, dated by its commit.

• Pod environment values are dropped as they arrive. A pod list carries them, and before this release they
  sat in memory for the whole run. The product never reads them, and now never holds them either.

• Text from your cluster is treated as data everywhere. An object name or status message can no longer:

  • drive your terminal with escape sequences;
  • inject Markdown into a ticket;
  • forge the marker that stops a duplicate ticket. The marker is now shoalcheck-dedup:, and tickets an older
    build filed are still found.

  The MCP server tells the assistant that quoted cluster text is data.

• The desktop window is locked down further.

  • It binds to a loopback address only.
  • Every route answers one method.
  • It opens only readings kept on this machine.
  • It prints a stopped run's message as text, not markup.

• Evidence packs are written owner-only.

• Vulnerability reports go to GitHub's private vulnerability reporting on this repository.

Licence charging, corrected

• A cluster that does not answer is not a reading. Nothing is kept and no licence slot is spent, on the command
  line and in the app. Before, three runs over a dead VPN could fill a Pro machine's clusters for 30 days.
• --redact no longer charges a second slot. A redacted reading is charged as the cluster it is.
• The app checks the licence before it streams anything. It checks that the licence covers this cluster before
  any finding is streamed; before, a key bound to another cluster saw the findings first and the refusal after.

CI/CD — new

• gate --with <rendered manifests>. Lays a pull request's manifests over the live reading and judges them
  before they land: the findings the change adds or removes, the dollar change, and what was not simulated.
  Nothing is applied.
• audit --capture + gate --capture. Judges a pull request from a CI runner with no cluster access, against
  a capture that is signed and states its age. Only a capture from a pinned key is judged.
• gate --manifests-only. Needs no cluster at all, and fails on what the change carries and cannot judge.
• --fail-on cost:+N. Fails when a change adds more than $N/month of identified cost.
• --update-baseline. Records only a run that passed, and writes the baseline whole.
• New outputs. findings -o junit, -o codequality (GitLab's merge-request widget) and -o md-summary (a
  pull-request comment).
• Ready-made jobs for GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Bitbucket Pipelines and CircleCI. Each
  judges a pull request's manifests, says when it cannot gate, and renders its CI's own report formats. One page
  explains which job fits which scenario.
• In the app.
  • Integrations hands out the job for each of the six CIs, pinned to this build.
  • Handoff writes JUnit, Code Quality and the pull-request summary from a kept reading.
  • A kept reading becomes the CI baseline, shown with the commands to commit it.

Team — new (Team plan, command line)

shoalcheck team keeps a team space in a folder your team already shares: a private git repository, or a synced
or network folder. There is no service of ours.

• What it holds.
  • The roster is the members' install keys. A join request is approved by its whole fingerprint, never by a name.
  • Each member writes a signed log of decisions: acknowledge, accept a risk, known issue, ticketed, assign,
    snooze, note. The logs merge per field, and two members changing the same field are shown as a conflict
    rather than one silently winning.
  • Published readings and CI run records, both signed.
  • A shared gate baseline, with the name of who set it.
• Commands. team mine is what is yours to look at. team log is the feed. team sync lists what changed;
  Shoalcheck runs no version control in the folder.
• What does not count. A record that does not verify is counted by reason, and never trusted.
• The gate. It says who set the team baseline it reads, and records the one it writes.
• Not yet in the app. The desktop app's Team screen follows in a later release.

A large cluster

On a synthetic 2,000-node, ~33,000-pod cluster served over HTTP, rc.11's audit did not finish in ten minutes:
its node-loss model grew as nodes × nodes × pods. This release reads that cluster, judges it and writes both
documents in about 5–6 seconds, with a peak of about 900 MB, on a 12-core Mac. At 4,000 nodes and 66,000 pods it
takes 9.5 seconds and 1.8 GB.

• Memory. Plan on roughly 1 GB for each 35,000 pods.
• What the figures leave out. They are measured against a local server; a real API server adds its own
  response time for every page.
• --redact is about 13 times faster on a large reading.
• How a list is read.
  • Pages of 500, one request at a time, at most 50 a second; never a watch.
  • A throttled list is retried with backoff.
  • An expired continue token restarts the list.
  • A list cut short is said ("cut short"), and its partial pages are not used.
  • Each page has 30 seconds, and a list has 10 minutes.

The engine (0.23.0)

A ground-truth benchmark plants 175 known problems in a live kind cluster and checks each rule against them. Engine
0.22.0 kept 162 and raised 12 false positives; 0.23.0 keeps 174, with 1 known false positive and its reason. Every
one of the 104 rules has ground truth. The method and the per-rule results are in docs/engine/benchmark.md.

• Pod security on bare Pods, Jobs and CronJobs. These were read but not judged before.
• The sample reading now has 153 findings (was 141); its dollar figure is unchanged.

Also fixed

• Preflight.
  • preflight drain A B assesses the nodes drained together as one change. Before, it answered for each node
    alone, and could pass a pair that leaned on each other.
  • Preflight says a cluster did not answer, rather than calling it empty or forbidden.
• Connections.
  • Every request is bounded. A server that never answers is not asked thirty more times.
  • Rejected credentials, a failed credential plugin and an untrusted certificate are each named for what they
    are.
• The command line.
  • Every output path is checked before the cluster is read, and nothing is overwritten without --force.
  • --help is free on every command.
  • findings --namespace includes the findings about the namespace itself.
  • A rightsizing recommendation is never zero.
  • --discount applies to node hours only, and says so.
  • A reading taken through the current context is named after it.
• Documents. The linear HTML document is bounded at 2,000 full cards and says where the rest are.
• The app.
  • A fleet draws one podium per cluster.
  • "Copy the command" copies the command.
  • Notices replace dialogs that the macOS window dropped.
  • A second reading is refused while one runs.
  • The update check retries within the hour.
  • A reading signed by another key says so.

Downloads.

• The command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows).
• The desktop app: Shoalcheck_<v>_macos_universal.dmg for macOS, and shoalcheck-app_<v>_<os>_<arch> for Windows
  and Linux (it opens in your browser).
• Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify.

1. Check the signature: cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt.
2. Check the files: shasum -a 256 --ignore-missing -c checksums.txt.

The public key is cosign.pub. cosign publishes no
Windows arm64 build; on Windows on Arm, its x64 build runs under emulation. The update manifest,
shoalcheck-update.json, is signed with a separate release key compiled into the binaries.

Not yet.

• Code-signed for Windows. SmartScreen asks once: More info → Run anyway.
• Licence keys on sale. The shop, https://shop.shoalcheck.com/buy, opens when the payment provider finishes
  reviewing it. Until then the free line is preflight in full and the size of any reading. The plans are Free,
  Pro, Team and Business; the one-off audit offers are withdrawn.

macOS. The app's disk image and the macOS command-line binarie...

v0.1.0-rc.9

The ninth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A correction,
and the reason this release exists — rc.8 could answer a zone question with a green light it had not earned — and the
gate's reading kept for the rest of a pipeline. A copy of rc.8 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key first.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

Corrected since rc.8

• Losing a cluster's only zone stops. On a cluster whose every node is in one zone, shoalcheck preflight zone <that zone> answered "✓ every pod this model can place has somewhere else to go", exit 0, beside a note saying
  zone-loss feasibility was not assessed — the opposite of the truth, since losing that zone loses every node. It
  now answers "✗ losing zone loses every node: this cluster has no other zone", exit 2, with one stop that
  says so; the app shows the same answer. A zone that holds some of the nodes is answered as before. In a reading,
  a single-zone cluster is still reported as not assessable per workload: listing every pod as having nowhere to go
  would describe the topology, not a workload.

New since rc.8

• shoalcheck gate --json <path> keeps the reading the gate compared, written before the comparison so a red
  build has it too: the next step of a pipeline — shoalcheck findings --input reading.json -o sarif for code
  scanning, an artifact for whoever opens the failure — rests on the reading the gate judged. The ready-made jobs
  for GitHub Actions and GitLab CI in the source repository use it; they also download from this releases
  repository, check the signature with the release key written into the job (a key fetched from the release it
  vouches for proves nothing) and pass the Team licence the gate needs from the CI secrets.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. cosign publishes no Windows arm64
build; on Windows on Arm its x64 build runs under emulation. The update manifest, shoalcheck-update.json, is
signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app (the disk image's "Read me first" says the same) — or
code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is
preflight in full and the size of any reading.

v0.1.0-rc.8

The eighth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A copy of
rc.7 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key first — and
from this release on, the offer says what changed and can be skipped.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

New since rc.7

• Findings go into Jira. shoalcheck ticket push --from report.json --tracker jira --project <KEY> --url https://<site>.atlassian.net --account <email> files each finding of a report audit --json wrote as one issue (Task unless --issue-type says otherwise), labelled
  so a second push finds it instead of filing it twice; the API token comes from the keychain or
  SHOALCHECK_JIRA_TOKEN and never reaches an error line. A project whose issue type requires a field this build
  does not fill is refused before anything is written, naming the field. Written from Atlassian's published REST
  reference and tested against a fake Jira Cloud — no request of it has reached a real Jira site yet, and the
  probe says so before the first push.
• A reading writes the workbench. shoalcheck audit --output reading.html writes the instrument you filter, cut
  and ask, the same as the app's; --linear asks for the printable document.
• One cluster, one reading, from either door. The command line now reaches the cluster's own Prometheus through
  the API server's service proxy, as the app does, so both price from the same week of usage instead of the
  command line falling back to one moment of metrics.
• The app draws a reading while it reads. The severity × category grid fills as findings arrive, the money
  counts up while pricing, and the graph appears while judging.
• Since last says how far apart two readings are, names the earlier reading's label, and lists the findings no
  longer in the set by id, rule and severity. Under --redact, a title only the earlier reading held is withheld.
• Every count adds up. The opening counts every reference to nothing; every control the reading judged is
  listed; the kinds read add up to the objects read; usage is said as it was read ("prometheus over 7d",
  "metrics.k8s.io at one moment"), and a fleet whose clusters read usage differently says its sum mixes them.
• A ranked list that stops says what it left out, and a node roll counts every node a drain stops on, not
  only those whose work has nowhere to go.
• The free line is one line on both surfaces: the size of any reading and its five most serious kinds. A free
  result says why nothing is compared, and what its figure rests on.
• Updates you can skip. Settings → Updates lists what changed (this release's eight lines, signed into the
  update manifest) and offers Skip this version.
• On a phone the reading's lists, the cut bar and the controls fit the screen.
• A sample's evidence pack says it is a sample in every file and in its manifest.

On the site (the same day): the price sits beside the way in; the hero's button and price are on the first
screen of a laptop; every tile can be read on a phone and every name is whole; the downloads below link this
release's own files; and every page drawn from the product is re-made from this release.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. cosign publishes no Windows arm64
build; on Windows on Arm its x64 build runs under emulation. The update manifest, shoalcheck-update.json, is
signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app (the disk image's "Read me first" says the same) — or
code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is
preflight in full and the size of any reading.

v0.1.0-rc.11

The eleventh release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A
correction, and the reason this release exists — GitHub code scanning accepted rc.10's SARIF and then could not file a
single result from it — and the ready-made CI jobs, published. A copy of rc.10 offers this one in Settings → Updates
(or shoalcheck upgrade), checked against the release key first.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

Corrected since rc.10

• The findings land in GitHub's security tab. SARIF placed each cluster object at a k8s:// address, so nobody
  could take it for a file in their repository; GitHub validated the file and then refused every result ("SARIF URI
  scheme "k8s" did not match the checkout URI scheme "file"") — it files results only under paths in the repository.
  A cluster object is now filed under live-cluster/<cluster>/<kind>/<namespace>/<name>: a path no manifest has, no
  line number, and the location says it is not a file; the object's identity and the finding's fingerprint are
  unchanged. Found by running the ready-made GitHub Actions job end to end in a public repository against a kind
  cluster, and checked there before release: the same reading filed 12 alerts.
• The ready-made jobs are published. They lived in the private source repository the rc.9 notes pointed to; they
  are at https://shoalcheck.github.io/ci/github-actions.yml and https://shoalcheck.github.io/ci/gitlab-ci.yml, and
  say what was learnt running them: the baseline must be a reading of the same cluster — shoalcheck knows a cluster by
  its kube-system namespace and refuses to compare two — so a cluster made new for every run records its baseline in
  the same run.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. cosign publishes no Windows arm64
build; on Windows on Arm its x64 build runs under emulation. The update manifest, shoalcheck-update.json, is
signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app (the disk image's "Read me first" says the same) — or
code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is
preflight in full and the size of any reading.

v0.1.0-rc.10

The tenth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. One
correction, and the reason this release exists: the findings rc.9 exported as SARIF were refused by GitHub code
scanning. A copy of rc.9 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release
key first.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

Corrected since rc.9

• GitHub code scanning accepts the SARIF. shoalcheck findings -o sarif tagged a security rule
  [shoalcheck, security, security] — its category, its pillar and the code-scanning marker each added the word —
  and SARIF requires a rule's tags to be unique, so GitHub refused the file ("tags contains duplicate item") and the
  "Upload to code scanning" step of the ready-made GitHub Actions job failed after the gate had run. Each rule's tags are now listed once; the findings, their rules and their levels are unchanged. Found by
  running that job end to end in a public repository against a kind cluster.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. cosign publishes no Windows arm64
build; on Windows on Arm its x64 build runs under emulation. The update manifest, shoalcheck-update.json, is
signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app (the disk image's "Read me first" says the same) — or
code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is
preflight in full and the size of any reading.

v0.1.0-rc.7

The seventh release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A copy of
rc.6 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key first.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

New since rc.6

• The sample reading has its cluster's own Prometheus, and the map shows the traffic it saw. The sample read its
  usage from one moment of metrics.k8s.io and drew no traffic, so the page meant to show the whole product showed
  its weaker half. Its cluster now holds a Prometheus and Cilium's Hubble, as clusters shaped like it do: every
  rightsizing figure rests on a week of usage, proven to be this cluster's before it is used; the alerts firing and
  the scrape targets down are findings; and the Topology workspace draws what talks to what — the flows between
  workloads, a second, with the share the cluster's own network policy dropped. 141 findings, $1,659 a month
  identified. Like everything in it, the sample is fictional and says so on every screen.
• What talks to what, in every reading that has the telemetry. Topology drew only declared wiring, under a
  caption saying so, even when the reading had measured the traffic: the observed map was in the classic report
  only. The instrument now draws it, laid out by who calls whom, each edge with its rate, dropped or failing edges
  marked, following the cut like the reachability graph.
• Hubble counts flows, and the map says flows. On a cluster whose telemetry is Hubble's network-level flow
  count, the classic report's map printed "12 req/s · 0%" — a unit Hubble does not count and an error rate it never
  observed — under a legend for errors and mTLS. An L4 edge now says "12 flows/s", and how much was dropped when
  policy dropped some; the map is laid out by call chain instead of two columns, so its labels sit in the gaps.
• An observed map is dated by the reading. It was dated by the moment the query ran; it now carries the
  reading's own time, like every other field of the reading.
• A reading's opening counts every node its preflight stops on. It said "4 nodes cannot be evacuated" on a
  reading whose preflight stops on five: the count had not heard of the rule rc.6 added for a pod no controller
  manages. The two lists are now held to each other.
• A finding that rests on telemetry says so. Alerts firing and scrape targets down rest on the cluster's own
  series and on no object; their basis read "not recorded" in findings, the app and every ticket. It now reads
  "no object kind, telemetry only · usage from prometheus".
• On a phone, a panel keeps its title and a graph keeps its scale. A long note beside a title shrank it to one
  letter, and the Topology and Access graphs were drawn too small to read; the note moves under the title, and a
  graph keeps a readable width and scrolls sideways inside its panel.
• The fleet sample shows two kinds of evidence side by side. Production and staging read their own Prometheus;
  the recovery cluster has no monitoring and reads a metrics.k8s.io snapshot — and each reading says which it had.

On the site (the same day): the zone scene is pinned only where it fits the screen; the video captions sit
under the frame; every figure in "your cluster, your numbers" is the one before it multiplied out; and every page,
screenshot, loop and video is re-made from this release.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. The update manifest,
shoalcheck-update.json, is signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app (the disk image's "Read me first" says the same) — or
code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is
preflight in full and the size of any reading.

v0.1.0-rc.6

The sixth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A copy of
rc.5 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key first.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

New since rc.5

• A drain now stops where kubectl drain stops on a pod no controller manages. kubectl refuses to evict such a
  pod unless it is given --force, and with --force deletes it for good; the drain model had answered "nothing
  this model checks stops the drain" for a node carrying one. A new rule, k8s.reliability.node-drain-unmanaged-pod,
  names the node and the pods, and preflight drain counts it as a thing that stops the drain. The engine moves to
  0.22.0 (88 rules), so a comparison with a reading taken by an earlier version says the rule set changed.

• render shows a saved fleet. shoalcheck fleet --json wrote a document nothing read back; render took it
  for a single reading with nothing in it and printed an empty page, without an error. It now renders the fleet —
  the overview, every cluster's reading, what they declare differently — on a Team licence, as fleet is. The
  commands that take one reading (findings, explain, evidence, support, gate, ticket) refuse a fleet by
  name instead of reading it as an empty one. --redact on a saved fleet is refused with the way to do it
  (fleet --redact), because what joins the clusters was derived from their names.

• A Pro key is not "the free line". Asking for a Team command on a Pro licence said "this machine has the free
  line"; it now says which licence the machine has.

• A fleet's money adds up on the page. Each cluster's figure is printed to the dollar and the fleet total said
  it was their sum while summing the unrounded values ($1,647 three times over $4,940). The total is now the sum of
  what is printed, in the fleet overview and the fleet document.

• On a phone, the "Illustrative sample" label stays in view. A fleet's header scrolled it out of a 390 px
  screen; on a phone every header now keeps the name and the label, and a long name shrinks before the label does.

• The reading, read the way a visitor reads it. Counts in words everywhere in the instrument ("4 nodes", not
  "4 node(s)"). The Blast radius marks every node the preflight stops on — it missed the new rule's node and
  zone-pinned volumes. "What the fleet is made of" no longer stretches to the height of the window. In Cost, a unit
  price prints to the cent so the count × price comes out, and a column that does not add up to its total because
  each row is rounded on its own says so with both figures. Compliance's list agrees with its strip on a control
  the assessment holds for a person to judge (5.1.7). A CronJob's card names its namespace and kind.

• Counts in words in every finding. "(s)" is gone from the descriptions and evidence too — "judged all 4
  Services", "3 nodes of m6i.xlarge" — not only from the titles; a gate holds every reading the site and the app
  are built from.

• A trace follows the chain. In the Access and Topology graphs, pinning a node lights everything upstream and
  downstream of it — a ServiceAccount, its bindings and the roles they reach — instead of stopping one edge away.

On the site (the same day): the landing's deadline calculator — a version's end of support and what extended
support costs, from the tables every reading uses; the zone scene's "ask it yourself", which plays the engine's
verdict for every zone and node of the sample; captions and chapters on the app video; a docs page; the sample
reading live in its frame; a sample fleet — the sample company's production, staging and disaster-recovery
clusters, each read by the engine, with what they declare differently; four short loops of the reading in use; and
a 53-second overview with subtitles, on a click.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. The update manifest,
shoalcheck-update.json, is signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app (the disk image's "Read me first" says the same) — or
code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is
preflight in full and the size of any reading.

v0.1.0-rc.5

The fifth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A copy of
rc.3 or rc.4 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key first.
On a Mac account with no Trash folder, the rc.3 and rc.4 apps stop that update safely, before changing anything;
download the disk image below instead. This release no longer needs the folder.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

New since rc.4 — from a second adversarial review of everything rc.4 shipped.

• A way back from a reading. A finished reading has "All clusters"; the list offers "Back to it".
• Nothing is asked of a cluster before you choose it. The window no longer probes the current context for
  Prometheus when it opens.
• What to do first names each object once, puts a critical first even when its fix needs a person, and never
  offers scaling up a workload with a high or critical security finding as the safest place to begin.
• The app does what it used to send you to a terminal for: Settings → Diagnostics writes the diagnostics file,
  and Plan & licence reads a cluster's fingerprint and says whether your key covers it. Plan & licence shows when
  the key ends.
• Every command the reading prints runs. Export & act printed five commands rc.4 refused; every printed flag is
  now checked against the real ones.
• The free line counts honestly: each of the five kinds counts findings at its own severity, "+N lower" says
  the rest, and two kind names no longer claim more than their findings say.
• Counts in words. "1 pod(s)" and "each of those 1 evictions" are gone from the preflight answers and from
  finding titles; a passing drain says nothing this model checks stops it, without promising the drain succeeds.
• Narrow windows: at 520 px the reading fits, Readings and the Queue keep every column's name, and the run
  header keeps the cluster's.
• Fixed: the app's local server served any report left in its temporary folder, including an earlier licensed
  copy's, and listed the folder; it now serves only what this launch wrote. A restart after an update on a fixed
  --addr waits for the port. A scheduled reading reads the kubeconfig the window read. The macOS app declares
  macOS 12, the oldest its toolchain runs on (rc.4 said 11). The disk image carries a "Read me first" that says
  how to open an app Apple has not notarized. Every command-line archive now carries a README written for the
  download, with no links to files it does not hold. upgrade offline says so in words; update names upgrade.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. The update manifest,
shoalcheck-update.json, is signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app — or code-signed for Windows (SmartScreen: More info →
Run anyway). Licence keys are not on sale yet; the free line is preflight in full and the size of any reading.

v0.1.0-rc.4

The fourth release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop. A copy of
rc.3 offers this one in Settings → Updates (or shoalcheck upgrade), checked against the release key first.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

New since rc.3

• A reading can be stopped. The app has a Stop button while it reads; a stopped reading writes, keeps and
  counts nothing. Every request of the run ends with it, discovery included.
• What to do first says how it ranks, and names the most severe finding its first three left out, with the
  reason — a finding whose own text says it may not apply ranks last, a critical included. The free line's five
  most serious kinds are now the five most severe.
• The fleet: shoalcheck fleet --instrument writes an overview of every cluster, each opening its full
  reading. fleet --label stores your words on every reading, and the instrument shows a reading's label at its top.
• A key says when it ends, in its last fourteen days: licence show, after an audit, and on the app's plan card.
• The app explains itself: Help has "When something does not work", with this machine's paths; Integrations
  says what each one needs; a rejected key, a missing kubeconfig and a refused update say why in words.
• macOS: the window has the Edit, App and Window menus, so ⌘C, ⌘V and ⌘Q work.
• Updates: "Install and restart" restarts; a restart refused during a reading says why; a folder the app
  cannot write names the download; the command line removes the copy a Windows upgrade moved aside.
• The instrument on a phone: the workspaces become a strip across the top, and the sample label stays in view.
• Fixed: --redact --label wrote the label into a redacted reading; it no longer does, in audit or fleet.
  deploy/rbac.yaml, the role the collector needs, is now in every command-line archive.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. The update manifest,
shoalcheck-update.json, is signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway, or remove the quarantine flag yourself with
xattr -dr com.apple.quarantine /Applications/Shoalcheck.app — or code-signed for Windows (SmartScreen: More info →
Run anyway). Licence keys are not on
sale yet; the free line is preflight in full and the size of any reading.

v0.1.0-rc.3

The second release candidate of Shoalcheck: read-only Kubernetes preflight and audit, from your laptop.

shoalcheck preflight drain node-1          # can this node be evacuated? exit 0 · 2 · 1
shoalcheck preflight zone eu-west-1a       # what has nowhere to go if this zone is lost?
shoalcheck preflight upgrade 1.34          # what stops the way to that version?
shoalcheck audit --context prod            # the size of the reading and its five most serious kinds, free
shoalcheck upgrade                         # replace this binary with the newest release, signature checked

New since rc.2

• Updates in place. shoalcheck upgrade, or Settings → Updates in the app. A release installs only if its
  manifest verifies under the Shoalcheck release key and the download's SHA-256 and version match what it
  signs. A copy Homebrew or krew installed is told their command instead. The app asks on its first screen
  whether to check once a day, and SHOALCHECK_NO_UPDATE_CHECK=1 forces that off. The check asks GitHub for
  this repository's releases and carries nothing about a cluster.
• A full desktop app. A first screen, Home, a Preflight screen (drain a node, lose a zone, the next
  upgrade), Plan & licence, Settings, Help and ⌘K. The sample reading is built in.
• The free line is the size of any reading: how many problems, how serious, of what kind, what they would
  cost at list price, and the five most serious kinds — never which objects.
• What it would take another way. A reading measures what it read (objects, bytes as kubectl prints them,
  rule × object checks) and prices the floor of reading the same with an AI agent's tokens, or by hand.
• Since the last reading names the new findings. Each one opens, and the figure cuts the table to them.
• Keys can be bound to the clusters they are sold for. shoalcheck licence fingerprint names a cluster;
  shoalcheck activate <key> installs a key. Keys are still not on sale.
• The app's local server answers only its own window: its own address, its own origin, and a per-launch
  session token on every request.
• Said as it is: a cluster nothing could be priced reads "unpriced" everywhere rather than $0; a cluster
  with no region has no gap in its header; RBAC subjects are labelled with their own kind.

Downloads. Command line: shoalcheck_<v>_<os>_<arch> (.zip on Windows). The desktop app:
Shoalcheck_<v>_macos_universal.dmg for macOS, shoalcheck-app_<v>_<os>_<arch> for Windows and Linux (it opens
in your browser). Also kubectl-shoalcheck (a kubectl plugin) and shoalcheck-mcp (an MCP server).

Verify. cosign verify-blob --key cosign.pub --bundle checksums.txt.sigstore.json checksums.txt, then
shasum -a 256 --ignore-missing -c checksums.txt. The public key is
cosign.pub. The update manifest,
shoalcheck-update.json, is signed with a separate release key compiled into the binaries.

Not yet: notarized by Apple — macOS stops the app the first time; open System Settings → Privacy & Security
and choose Open Anyway — or code-signed for Windows (SmartScreen: More info → Run anyway). Licence keys are not on sale yet; the free line is preflight in full and
the size of any reading.