v0.3.2

Fortem v0.3.2 — optional Jev decision preview

Fortem v0.3.2 adds a safe, opt-in Jev/System One preview for incident
assessment. The local rules engine remains the default and fallback.

Changes

• fortem jev configure, status and remove manage a local Jev API key;
• the key stays outside the browser and logs, with a private local file or
  TYPESAFE_API_KEY for automation;
• Jev receives a normalized incident projection rather than kubeconfig,
  credentials or raw logs;
• evidence, caveats, next checks and provider/model provenance remain visible;
• unavailable Jev responses fall back to the local rules engine;
• the current BYOK preview and its evaluation boundary are documented for
  future Pro/Teams packaging.

This does not enable autonomous remediation or claim verified root cause.

Upgrade with Homebrew:

brew update
brew upgrade --cask fortem

Or re-run the checksum-verifying installer:

curl -fsSL https://fortem.dev/install.sh | sh

v0.3.1

Fortem v0.3.1 — clearer GKE node capacity

Fortem v0.3.1 makes missing node information actionable and adds useful
node-pool capacity/load summaries across GKE, EKS and AKS.

Changes

• groups nodes using standard provider labels, including
  cloud.google.com/gke-nodepool, and shows pool-level allocatable,
  requested and current CPU/RAM;
• distinguishes core Node access from optional Kubernetes Metrics API access;
• shows safe kubectl auth can-i checks when the current kubeconfig identity
  cannot read node inventory or node metrics;
• extends fortem --doctor output with the relevant permission checks;
• records real environment and node resource history locally once per minute,
  retains 24 hours and displays the latest six hours;
• preserves unavailable Metrics API samples as gaps instead of zero.

No Helm chart, in-cluster Fortem component or Google Cloud API access is needed.
Fortem remains local and read-only by default.

Upgrade with Homebrew:

brew update
brew upgrade --cask fortem

Or re-run the checksum-verifying installer:

curl -fsSL https://fortem.dev/install.sh | sh

Then confirm fortem --version reports 0.3.1 and run:

fortem --doctor --context YOUR_CONTEXT

Release archives cover macOS, Linux and Windows on amd64 and arm64. They are
checksum-verified but not yet Apple-notarized or Windows
Authenticode-signed.

v0.3.0

Fortem v0.3.0 — evidence-first incident triage

Fortem v0.3.0 turns the local Kubernetes workspace into an evidence-first
incident path. It remains local, read-only by default, and installable without
a Helm chart or in-cluster Fortem component.

Highlights

• correlates workload readiness, restarts, termination reasons, resource
  boundaries, recent changes, events, reduced log patterns, and optional
  ingress traffic in one incident brief;
• keeps observed facts visually and structurally separate from ranked
  hypotheses, with evidence links and a caveat on every hypothesis;
• opens the next useful read-only check in Workloads, Events, Traffic, or Logs;
• runs a transparent deterministic assessment engine entirely locally by
  default;
• stores helpful/not-helpful assessment feedback in an inspectable local JSONL
  file without uploading it; POSIX files are created with mode 0600, while
  Windows uses the containing user-profile directory ACL;
• ships a realistic synthetic OOMKilled investigation and an aligned standalone
  browser demo;
• includes an explicitly opt-in experimental Jev adapter with redacted bounded
  state, output validation, unchanged-state caching, and local fallback.

The Jev adapter has not passed Fortem's Kubernetes evaluation gate and is not a
root-cause, calibration, or automation claim. Decision output never authorizes
a mutation. The normal fortem, fortem --demo, and fortem --doctor paths do
not contact an external decision provider.

Start safely with:

fortem --demo

Release archives cover macOS, Linux, and Windows on amd64 and arm64 and are
checksum-verified. They are not yet Apple-notarized or Windows
Authenticode-signed.

v0.2.1

Fortem v0.2.1 — first-run and Pro hardening

This patch release focuses on the path from installation to a real Kubernetes
workspace and on safe paid activation.

Highlights

• adds a browser-first context, namespace scope, and read-only preflight flow;
• honors merged KUBECONFIG paths when no explicit file is supplied;
• keeps context selection available when a cluster read or authentication fails;
• lets Pro users choose the contexts included in a fleet, up to their signed limit;
• adds fortem license install PATH and fortem license doctor;
• falls back to Free with a clear notice when a newer binary is outside the
  license update window instead of refusing to start;
• updates the embedded dashboard and packaged documentation.

Fortem remains local, loopback-only by default, and read-only unless explicitly
started with --manage. Release archives are checksum-verified but are not yet
Apple-notarized or Windows Authenticode-signed.

v0.2.0

Fortem v0.2.0 — Kubernetes pivot

Fortem is now a local Kubernetes environment inspector delivered as one Go
binary with an embedded web interface.

Included

• macOS, Linux, and Windows archives for amd64 and arm64;
• checksum-verifying shell and PowerShell installers;
• Homebrew installation through cybrixcc/tap/fortem;
• local loopback server with an existing kubeconfig and selected context;
• read-only operation by default, with guarded restart and scale actions;
• namespace environments, workloads, pods, resources, events, logs, routing,
  node and Karpenter NodePool views;
• optional metrics-server and ingress-nginx Prometheus/access-log sources;
• a fully synthetic demo and offline-signed Pro fleet license support.

Start safely with:

fortem --demo

The archives are checksum-verified but are not yet Apple-notarized or Windows
Authenticode-signed. No Helm chart or in-cluster Fortem agent is required.

Fortem v0.1.0 — local Kubernetes environments

Fortem v0.1.0 is the first public binary release of the local Kubernetes product.

Install

Homebrew (macOS or Linux)

brew install cybrixcc/tap/fortem

macOS or Linux installer

curl -fsSL https://github.com/cybrixcc/fortem-releases/releases/latest/download/install.sh | sh

Windows PowerShell

irm https://github.com/cybrixcc/fortem-releases/releases/latest/download/install.ps1 | iex

Until the new fortem.dev site is promoted to production, the checksum-verifying installer scripts can be reviewed on its release preview. The Homebrew command and direct archives on this page are live now.

What is included

• one local Go process with an embedded browser UI;
• existing kubeconfig contexts; no required Helm chart or in-cluster agent;
• EKS, GKE, AKS, kind, and k3s through standard Kubernetes APIs;
• namespace environment overview, workloads, pods, images, requests/limits, optional usage, events, logs, Services, Ingresses, EndpointSlices, nodes, and Karpenter NodePools;
• optional ingress-nginx Prometheus traffic metrics and parsed controller access logs;
• a realistic synthetic demo that does not require Kubernetes credentials;
• read-only mode by default; restart and scale are available only after explicit --manage, confirmation, and Kubernetes authorization checks.

Start safely

fortem --version
fortem --demo
fortem --doctor --context YOUR_CONTEXT --namespaces staging,production
fortem --context YOUR_CONTEXT

The demo is synthetic. --doctor checks connectivity and read permissions without starting the UI or mutating resources.

Distribution and security boundary

Six CGO-free archives are attached for macOS, Linux, and Windows on x86_64 and arm64. Verify downloads with checksums.txt; the website installers do this automatically. Checksums verify integrity but are not code signing. Apple notarization, Developer ID signing, Windows Authenticode, and an automated SBOM are not included in v0.1.0.

Fortem uses your existing authentication helpers, VPN/network path, and Kubernetes RBAC. Kubeconfig and credentials stay in the local backend process and are not sent to browser JavaScript. Optional metrics are shown as unavailable or partial when their source or permission is missing.

Current limits

• one selected kubeconfig context per local process;
• namespace-as-environment model;
• metrics-server is optional for current CPU/memory usage;
• the first traffic adapter targets ingress-nginx with an explicitly configured Prometheus endpoint and/or controller logs;
• Windows archives are cross-built and checksum-tested but still require acceptance testing on a real Windows host;
• binaries are currently unsigned.

Use of the unmodified local binary is covered by the Fortem Local Binary License included in every archive. Third-party notices are included as well.