TypeSafe Place 0.2.1 (River Oaks)

TypeSafe Place 0.2.1 (River Oaks) for Apple Silicon Macs: the first build signed with a Developer ID certificate and notarized by Apple.

Changes

• Signed and notarized.
  • The app is signed by Soul Protocol LLC (Developer ID, team 9LR8Z8UQ9X) with the hardened runtime, and Apple notarized it. macOS opens it without the unidentified-developer warning.
  • The notarization ticket is stapled, so the first launch does not need to reach Apple.
• Fewer permissions. The app may use JIT, which V8 needs, and the microphone, which shared voice asks for only after you choose Unmute. It gets nothing else: no camera, location, Bluetooth, USB or printing.
• Encrypted cookies. Your session cookie is now encrypted with a key in your Keychain. Cookies saved by 0.2.0 still work after the update, so you stay signed in.
• Hosted game. The game itself is served from main and was already live before this release. Since 0.2.0 that includes:
  • players staying connected through server rotation (#447), with voice surviving that hand-over (#454);
  • IPIC theater and lounge improvements (#453, #465);
  • green roofs and live office outlooks (#449, #450);
  • a smoother office lift (#460);
  • the Studio House template and Garden Office fixes (#466, #452);
  • a clearer waitlist (#451), usernames with at least 4 letters (#458), and steadier avatars on iOS Safari (#436).

The full notes, with compatibility and rollback guidance, are in docs/releases/0.2.1.md.

Desktop installation

1. Download TypeSafe-Place-0.2.1-macOS-arm64.zip.
2. Unzip it.
3. Move TypeSafe Place.app to Applications, replacing 0.2.0 if you have it.

The app needs an internet connection, GitHub sign-in through the system browser, and waitlist approval. The first time it saves your session, the app stores its cookie key in your login Keychain. macOS lets later updates signed by the same team use that key, as Chrome's updates do.

Rolling back to 0.2.0 signs you out: 0.2.0 cannot read the encrypted cookie store and clears it. Your preferences and window position are kept.

SHA-256: fa5e7e2cb2c92cf74ec07b784f07243bb14f6cdd57ab7e9c972c41467c1f270c

Verification

Release build. It ran in a clean, detached worktree at the tag commit 19d11250, with its own pnpm install:

• pnpm run test:desktop: 76 of 76.
• pnpm run desktop:package succeeds. desktop:package:check passes: the ASAR holds exactly the allowed desktop files, and the Electron fuses match, with cookie encryption on.
• The desktop end-to-end test, using the loopback acceptance fixture, passed all 13 of its checks.

Signing and notarization (pnpm run desktop:sign):

• Authority chain: Developer ID Application: Soul Protocol LLC (9LR8Z8UQ9X), then Developer ID Certification Authority, then Apple Root CA.
• Hardened runtime and a secure timestamp. The entitlements are exactly com.apple.security.cs.allow-jit and com.apple.security.device.audio-input.
• Apple notarization 055e4bd7-e036-4248-8a60-7e189fe692a0: Accepted, with no issues. The ticket is stapled and validates.
• spctl accepts the app: "Notarized Developer ID". This was also checked on the app unzipped from this archive and marked as downloaded (quarantined).
• A launch with a scratch profile started the app and its helpers and reached the sign-in step.

Not verified:

• live authenticated play in the packaged app, which needs an approved account and an interactive sign-in;
• human accessibility review;
• quiet-machine shared/full browser and 60 Hz acceptance;
• production migration acceptance;
• Windows, Linux or native Unreal packages.

Delivery

Release #467 was merged as 19d112502a557b8b172e8449cac4d7bbe4510909 after all checks passed. That commit was the head of main when the build started and when it was signed. The tag v0.2.1 is signed and verified. The same PR resolved code-scanning alert #4 (a test that built code from a temporary path). CodeQL's analysis of this commit closed that alert, and the repository has no open code-scanning alerts. The release ledger, docs/superpowers/plans/2026-10-15-release-0.2.1.md, records the checks and the signing receipt.

TypeSafe Place 0.2.0 (River Oaks)

TypeSafe Place 0.2.0 (River Oaks) for Apple Silicon Macs.

Changes

• Office and IPIC.
  • Resident-owned office computers with private and shared tasks.
  • An IPIC cinema interior, built from photos, with synchronized screenings, captions and the approved original short as the default screening. Hosting stays off until a host is named.
  • Shared darts in the IPIC Tuck Room, and an unbranded Axe & Darts room.
• Penthouse office, behind a layout flag; the existing office stays the default.
  • Server-run floors, stair and lift, and seats you can claim.
  • A glazed curtain wall with a skyline view.
  • The tower raised to 33 m.
• Building levels and World Studio. Generated building levels, World Studio building and room templates with local drafts and import/export, and a two-level public gallery pilot.
• Play and interface.
  • More shared plaza games and guided lessons, nearby greetings and shared voice, the Places guide, an expandable minimap, and updated chat and settings.
  • On phones, the greetings card no longer covers Play & rides.
• Performance and connections. The IPIC auditorium draws only the cinema when you are inside: the seated view went from 555 to 99 draw calls. Plus access, checkpoint and collision hardening and a 30-second reconnect grace.
• Desktop. Packages now build on Windows, Linux and macOS in CI, and Studio prompts are passed on stdin. Only the macOS package is released here.

The full notes, including the compatibility and rollback guidance, are in docs/releases/0.2.0.md.

Desktop installation

1. Download TypeSafe-Place-0.2.0-macOS-arm64.zip.
2. Unzip it.
3. Move TypeSafe Place.app to Applications.

This is an ad-hoc-signed build. It is not Developer ID signed or Apple notarized, so macOS will warn the first time you open it. The app needs an internet connection, GitHub sign-in through the system browser, and waitlist approval.

The desktop app is a thin hosted-game client: it loads https://typesafe.place/play, and the archive contains no offline renderer. The hosted game is deployed from main (currently 6dac1b21). That already includes changes merged after this tag, for example:

• connection hand-overs, so players stay connected through server rotation (#447);
• voice that stays in the room across those hand-overs (#454).

SHA-256: 5c3ae6a4a450de18a03ed33d7a67573c9c96b6b2ee09df792e7b6f5cdd4c28b0

Verification

Packaging and desktop checks. These ran in a clean, detached worktree at the tag commit e87b458e, with its own pnpm install:

• pnpm run test:desktop: 69 of 69.
• pnpm run desktop:package succeeds. desktop:package:check passes: the ASAR holds exactly the allowed desktop files, and the Electron fuses match.
• The desktop end-to-end test, using the loopback acceptance fixture, passed all 13 of its checks.

The packaged app:

• reports 0.2.0, with bundle id works.jev.river-oaks;
• passes codesign --verify --deep --strict (ad-hoc signature).

Before merging. #376 merged after all hosted checks passed on its final head, whose tree is identical to the tag. The core gate passed on the refreshed candidate: tooling, preview, server (Redis cases ran separately), desktop, Python, build, lint and secret scans.

Not verified:

• live authenticated play in the packaged app (it needs an approved account and an interactive sign-in);
• human accessibility review;
• quiet-machine shared/full browser and 60 Hz acceptance;
• production migration acceptance;
• Windows, Linux or native Unreal packages.

Delivery

Release #376 was merged as e87b458ec7883c2355c0f3e1028b07a65120355f after all checks passed. The tag v0.2.0 is signed and verified. The readiness ledger, docs/superpowers/plans/2026-10-14-release-0.2.0-readiness.md, records the candidate history and the remaining release gates.

TypeSafe Place 0.1.6 (River Oaks)

TypeSafe Place 0.1.6 (River Oaks) for Apple Silicon Macs.

Changes

• Refreshed login and connection screen with the district's ivory, teal and orbital-garden look. GitHub, email and invitation sign-in, the waitlist and the CSRF protections are unchanged.
• Your town admission survives the latest district update. The hosted town now carries saved checkpoints across the public facade-height edits instead of refusing them, and keeps owned seats and active wishes.
• Storefronts and paving match Street View. Gray stone strip paving with terracotta accents replaces the warm herringbone, the Cartier corner is reworked, and Hopdoddy's trees sit where the photos show them.

Desktop installation

Download TypeSafe-Place-0.1.6-macOS-arm64.zip, unzip it, and move TypeSafe Place.app to Applications. This is an ad-hoc-signed build, not Apple notarized. It needs an internet connection, GitHub sign-in through the system browser, and waitlist approval.

The desktop app loads https://typesafe.place/play. It is a thin hosted-game client; the archive doesn't contain an offline renderer.

SHA-256: 9ee2bea75178fc3db14b02d8deabef6c370e7651e7841fb27441a0c843749114

Verification

Built from a clean worktree at the release merge commit, with its own npm ci:

• npm test: 2,504 pass, 0 fail.
• npm run test:server: 276 pass, with 102 Redis-only cases skipped.
• npm run test:desktop: 9 of 9.
• npm run build and npm run desktop:package succeed.
• The desktop end-to-end test with the loopback acceptance fixture passed all 12 of its checks.

The packaged app:

• reports 0.1.6
• passes codesign --verify --deep --strict
• has Electron fuses matching desktop/fuses.js
• holds only the desktop modules and package metadata in its ASAR

Production is deployed at the release commit.

Not verified: live authenticated play in the packaged app (it needs an approved account and an interactive sign-in), human accessibility, and Windows, Linux or native Unreal packages.

Delivery

Version bump #192, merged as 5f6a0c6a15db7c2fbb73932e56e12e55200c37ee after all checks passed. The tag v0.1.6 is signed. Changes since v0.1.5: #187, #190 and #191.

TypeSafe Place 0.1.5 (River Oaks)

TypeSafe Place 0.1.5 (River Oaks) for Apple Silicon Macs.

Changes

• Walking actions behave predictably.
  • An action that is still running (sitting down, watering, stepping through a door) keeps its place, so a second press can't trigger something else.
  • A clicked or tapped action no longer stays pinned as the main one. Keyboard focus still holds its place.
• Clearer messages. Refused trips, doorways and meetings explain themselves instead of showing internal codes. A meeting refused by the travel cooldown now says to wait a moment, not that there's no clear place.
• Commands search opens Places or People when you type their names, instead of hiding the sidebar. "rail", "sidebar" and "play" find the panel toggles.
• Seating: one Stand up control. The seats panel no longer duplicates it, and the two can't send overlapping commands.
• Photo mode:
  • One share sheet at a time.
  • The quality hint no longer suggests switching to Sharpest when you're already on it.
  • Slider values are no longer read out as part of each slider's name.
  • No per-frame work while the photo panel is open.
• Boutiques: doorways keep their full width clear inside room layouts.
• Reliability: more of the game is now checked automatically on every change: shared-town journeys, CPU-rendered contextual, photo and command journeys, and three journeys updated for the shared town.

Desktop installation

Download TypeSafe-Place-0.1.5-macOS-arm64.zip, unzip it, and move TypeSafe Place.app to Applications. This is an ad-hoc-signed build, not Apple notarized. It needs an internet connection, GitHub sign-in through the system browser, and waitlist approval.

The desktop app loads https://typesafe.place/play. It is a thin hosted-game client; the archive doesn't contain an offline renderer.

SHA-256: 2f400a292009c88ac43d2b43868396cb1b38eaedcd3c75daff31d19672895485

Verification

Built from a clean worktree at the release merge commit, with its own npm ci:

• npm test: 2,501 pass, 0 fail.
• npm run test:server: 267 pass, with 101 Redis-only cases skipped.
• npm run test:desktop: 9 of 9.
• npm run build and npm run desktop:package succeed.
• The desktop end-to-end test with the loopback acceptance fixture passed. It covers assets and a playable character, sandbox and renderer isolation, keyboard movement, shop entry and exit, a resident conversation, graphics persistence and fullscreen.

The packaged app:

• reports 0.1.5
• passes codesign --verify --deep --strict
• has Electron fuses matching desktop/fuses.js
• holds only the desktop modules and package metadata in its ASAR

Production is deployed at the release commit.

Not verified: live authenticated play in the packaged app (it needs an approved account and an interactive sign-in), human accessibility, and Windows, Linux or native Unreal packages.

Delivery

Version bump #189, merged as 9b25e188dfcbf12c7d9fe061450b5a3032fb754a after all checks passed. The tag v0.1.5 is signed. Changes since v0.1.4: #180–#186 and #188.

TypeSafe Place 0.1.4 (River Oaks)

TypeSafe Place 0.1.4 (River Oaks) for Apple Silicon Macs.

Changes

• One contextual walking action with secondary actions under More actions; clearer Explore, People, Character and Camera commands.
• Keep your last photo across closing/reopening. Failed replacement preserves it; Discard removes it explicitly. Framing values, PNG dimensions and graphics-quality limits are visible.
• Includes the TypeSafe Place branding and hosted URL introduced since 0.1.3, shared-town admission, district facade improvements and source-level native developer workflows.
• Disables unused Unreal Android FileServer/network access to prevent generated credentials in tracked config.

Desktop installation

Download TypeSafe-Place-0.1.4-macOS-arm64.zip, unzip, and move TypeSafe Place.app to Applications. This is an ad-hoc-signed build, not Apple notarized. It requires an internet connection, GitHub sign-in and waitlist approval.

The desktop app loads https://typesafe.place/play. It is a thin hosted-game client; the archive does not contain an offline renderer. Packaging is separate from hosted deployment.

SHA-256: 84c0e25b2a0df1623565a8832cabd1723b080785ce405b79197119808d530ec3

Verification

Local full gate: 16/16 tasks, including 18/18 shared journeys, Redis tests, both secret scans and browser security. Five targeted UI journeys passed. Release build: desktop tests 9/9, production build, macOS arm64 packaging, strict codesign verification, Electron fuses, byte-matched ASAR and ZIP integrity passed.

Live authenticated gameplay, human accessibility, real native OS sharing, Windows/Linux packages and native Unreal/Android packaging remain unverified. Release-specific hosted checks, source revision and final cleanup evidence are recorded below and in the attached delivery audit.

Delivery

Merged PR #179 as 20208490353808213c962ccedd0923c38d17c1a8. All 10 PR check runs and Vercel passed; the merged tree exactly matches the checked PR tree. Vercel also reported success for the merged commit. Main CI reruns independently.

Before release: zero open PRs, only main locally/remotely, and one preserved primary worktree. The older stash and two unrelated local files were preserved unchanged. No force deletion was used.

River Oaks 0.1.3

The third patch release of the River Oaks desktop app, for Apple Silicon Macs.

Important: sign-in is now required

This version is a different kind of app from 0.1.2:

• You sign in with GitHub, in your system browser, and need waitlist approval before you can play, including solo play.
• It plays the hosted game at sim.jev.works, so it needs an internet connection, and you always get the latest deployed version of the district.
• Your approved session is kept until you sign out or it expires.

If you need to play offline or without an account, keep 0.1.2, the last standalone build.

What's new

• Shop staff and guests have their own faces. All 169 people working and shopping in the boutiques now have distinct faces, like the street residents.
• Shared worlds keep track of you. Your appearance carries across worlds, place links stay in the world they were shared from, and accepted contacts show which world they're in.
• Phone-sized windows: the hold-to-sprint button (beast form) meets the 44 px touch target.

Install

1. Download River-Oaks-0.1.3-macOS-arm64.zip and unzip it.
2. Move River Oaks.app to Applications.
3. This build isn't signed or notarized by Apple. The first time, Control-click the app and choose Open.
4. Sign in with GitHub when your browser opens.

SHA-256: 9563ba3ed81c7b5834de368a036b42948921eb4457db951ef325af620d3870e2

Verification

Built from 42ba460 with a clean npm ci. Unit (647), server (140) and desktop (6) tests pass, and the desktop end-to-end check passes using a local test identity (its fullscreen step timed out once on this Mac and passed on rerun). The packaged bundle loads sim.jev.works, which currently runs the same main, and production GitHub sign-in responds. Completing sign-in with an approved account was not tested for this release.

River Oaks 0.1.2

The second patch release of the River Oaks desktop app, for Apple Silicon Macs.

What's new

Characters

• Every resident has their own face. The six resident models carry 25 face-shape controls (head shape, nose, mouth, chin, cheeks, eyes, brows), and each resident gets a stable mix, baked once when they load at no cost per frame. Jevica and Prince Jev keep their authored faces.
• Every character has a humanoid and a beast form.
• Borrowed hairstyles bend with the neck and back like the models' own hair.

Birds you can see

• Jev's birds now fly low enough to see from the street, and one keeps you company, circling the spot you're looking toward. On the street a bird is in view about half the time (it was never in view before). Ride-along views are lower and closer while a bird circles.

Play together

• Choose solo or multiplayer at the start, with WorkOS sign-in for shared play.
• Shared worlds: Jevica-owned and creator-authored regions publish as shared worlds, with an admin world studio, revision drafts and live migration.
• Contacts and private messages between residents, invitations to a contact's current world, and resident profiles that persist across worlds.
• Saved landmarks and private building designs follow your account.

Fixes

• Faster boutique routing; the dev town join retries during startup; a mode switch survives storage refusals.

Install

1. Download River-Oaks-0.1.2-macOS-arm64.zip and unzip it.
2. Move River Oaks.app to Applications.
3. This build isn't signed or notarized by Apple. The first time, Control-click the app and choose Open.

SHA-256: a4561bf843c14e386c54ce732694f2e463d6e799f80f2e8104009aa4ecfbb5ce

Verification

Unit (643), server (118) and desktop (6) tests pass, and the packaged app passes its end-to-end test. Built from ff24c2a.

River Oaks 0.1.1

The first patch release of the River Oaks desktop app, for Apple Silicon Macs.

What's new

Characters

• Every resident, shop guest and Prince Jev now appears in the People list and conversation header by a portrait taken from their own 3D model.
• Residents are visibly different people: each has their own hair colour from a natural palette, and half wear a hairstyle fitted from another model.
• Prince Jev's sapphires refract only when close, cutting about a third of the triangles drawn each frame at street distance.
• Starting a conversation stops you where you stand, instead of sliding into it.

Interface

• A slimmer walking console that keeps more of the street in view.
• The play rail fades at its edge while there's more to scroll, instead of cutting a card in half.
• Refused actions say why, where you're looking (for example, why you can't take flight indoors).
• Accessibility: zero WCAG 2.2 AA violations across the main views at desktop and phone sizes. The 3D view now announces itself to screen readers, and the Places headers meet the minimum tap size.

Install

1. Download River-Oaks-0.1.1-macOS-arm64.zip and unzip it.
2. Move River Oaks.app to Applications.
3. This build isn't signed or notarized by Apple. The first time, Control-click the app and choose Open.

SHA-256: 009a93b1139aea1e3cdb6b32f8bd8aef1fe34d62fa38c07f6bbb43da67139bda

Verification

Unit (608), server (78) and desktop (6) tests pass, and the packaged app passes its end-to-end test.