# Install Fortem safely

Fortem is a local, evidence-first Kubernetes incident workspace. The installer
downloads one release archive, verifies its SHA-256 checksum, and installs only
the `fortem` binary. It does not read kubeconfig, contact a cluster, start
Fortem, or enable management mode.

## macOS and Linux

Review <https://fortem.dev/install.sh>, then run:

```sh
curl -fsSL https://fortem.dev/install.sh | sh
```

The default destination is `~/.local/bin/fortem`. Override it with
`FORTEM_INSTALL_DIR`. The script detects macOS/Linux and x86_64/arm64, resolves
the latest GitHub release, downloads the matching archive and `checksums.txt`,
and refuses to install when the checksum does not match. If `~/.local/bin` is
not on `PATH`, the installer prints both an absolute command that works
immediately and the exact `export PATH=...` line for future shells.

Homebrew is also supported:

```sh
brew install cybrixcc/tap/fortem
```

## Windows PowerShell

Review <https://fortem.dev/install.ps1>, then run:

```powershell
irm https://fortem.dev/install.ps1 | iex
```

The default destination is `%LOCALAPPDATA%\Fortem\bin`. The script downloads the
matching x86_64 or arm64 ZIP, verifies its SHA-256 checksum, installs
`fortem.exe`, and adds that directory to the current user's PATH when needed.

## Verify without touching a cluster

```sh
fortem --version
fortem --demo
```

Demo mode uses synthetic data and does not read kubeconfig. Before using a live
context, inspect permissions with `fortem --doctor --context CONTEXT`. Fortem is
read-only by default; do not add `--manage` unless you intentionally want the
documented, confirmation-gated mutations.

Running `fortem` loads the standard merged kubeconfig rules: every file in
`$KUBECONFIG`, or `~/.kube/config` when that variable is unset. The local UI
asks you to choose a context and optional namespace scope, runs the same
read-only preflight, and only then opens the workspace. To preselect a scope:

```sh
fortem --context CONTEXT --namespaces staging,production
```

Fortem never sends kubeconfig or credentials to the browser. The browser talks
only to the loopback Go process.

Fortem can invoke the external authentication command named by kubeconfig. It
does not replace AWS CLI, gcloud, Azure CLI, kubelogin, OIDC login, VPN access,
or private-cluster connectivity. Never send kubeconfig or credentials to a web
page or coding agent.